Security breaches have business implications that reach far beyond IT disruption. For senior cybersecurity professionals this means that in addition to keeping the organization secure and cyber resilient, they need to know how to effectively communicate cyber risk to very different and often non-technical stakeholders. Recent research shows that this isn’t always easy.

Communication gap

One international study found that 35% of IT professionals in smaller companies believe their senior management doesn’t see cyberthreats as a significant risk. However, a quarter of the IT staff admitted that leaders aren’t kept up to date about threats facing the organization. The two factors are closely related, because it is difficult to be interested in or care about something you don’t fully understand.

To bridge this gap, CISOs are learning to become effective storytellers, able to influence people at all levels in the organization and help them understand the cyber risks facing the business and the potential outcome and impact of an attack. This is business critical if senior managers are to invest in and engage with security policies, incident response, and more.

The best place to start is by understanding the perspectives and priorities of different stakeholders and building the security conversation around that.

Three essential conversations

Security leaders should prioritize three key conversations to effectively communicate cybersecurity risks and strategies. At a foundation level, they need to engage regularly with technical colleagues such as engineers, developers, and security researchers. Building strong relationships with these individuals and understanding security from their perspective is crucial, as these are the people security leaders rely on in a crisis.

Second, CISOs should maintain regular, scheduled meetings with senior managers, including the chief executive or their equivalent and critical business risk departments like finance and legal. These conversations should focus not just on evolving threats and security tools, but on what an incident might mean for the product or business roadmap, risk, compliance, and customers.

Finally, security leaders need to effectively communicate those who advise the business, such as the board of directors. Board members and non-executive directors bring a wide range of experience and backgrounds to the table. The golden rule here is to address everyone’s needs and concerns and keep things high level and simple.

Business leaders care about organizational resilience in the face of increasingly common, unpredictable, and potentially destructive cyber incidents. Board members expect security leaders to understand and address critical risks facing the company, such as supply chain vulnerabilities, and to outline potential consequences of successful attacks. Additionally, they want to know that their security teams has developed robust response and recovery strategies to ensure business continuity in the event of a breach.

Effective communication is a critical skill for security leaders. By engaging in these three key conversations and tailoring their message to each audience, security leaders can better convey the importance of cybersecurity measures, gain support for their initiatives, and ultimately improve their organization’s resilience against cyber threats.

The author is Riaz Lakhani, CISO at Barracuda Networks Inc

Disclaimer: The views expressed are solely of the author and ETCISO does not necessarily subscribe to it. ETCISO shall not be responsible for any damage caused to any person/organization directly or indirectly.