Trey Ford and RSnake did a surprisingly great demo day with Reach Security.  It blew what little hair RSnake has left back. A person-based risk approach to IT governance and control? Who would have thought of such a thing?  Definitely worth a watch if you control security at a large organization.