How Security Leaders Communicate Cybersecurity Risk to Executives

Cybersecurity leaders communicate information that is complex, consequential and often difficult to put into perspective.

Executives and board members need to understand the organization’s exposure, but they rarely need every technical detail behind it. They need to know which risks matter most, what those risks could mean for the business and where leadership attention or investment is required.

In this episode of What’s Your Story, Sally Williamson talks with Kim Keever about how security teams can communicate cybersecurity risk without overwhelming listeners or creating unnecessary alarm. Their conversation offers a practical lesson for every technical leader: expertise creates value only when other people can understand its significance.

Communicate Cybersecurity Risk to Executives: Connect Cybersecurity Risk to Business Decisions

Every communicator plays a significant role within an organization, but some of those roles get more visibility than others. Sales shares about customer insights, marketing relays their brand and product strategies, and something we’ve seen grow in the last five years, is that data security teams have become big communicators, with many CISO’s managing the communication to leadership teams and corporate Boards as it pertains to being able to communicate cybersecurity risk to executives.

On this episode of What’s Your Story, Sally connects with Kim Keever, Senior Vice President and Chief Information Security Officer of Cox Communications, one of the leading cable, internet and home automation providers to talk about the increased demand for security insights and how she brings clarity to a pretty complex topic.

More About Kim Keever

Kim Keever is Chief Information Security Officer (CISO) and Senior Vice President of Security, Analytics and Technology Services for Cox Communications (CCI) in Atlanta, Georgia. Her teams are responsible for all aspects of Information Security for Cox Communications; the Technology, Product and Operations Center of Excellence for Analytics; and for Technology people programs. In early 2016, Kim’s team received an innovation award from CSO Magazine, and Kim was named a top woman in technology by Multichannel News. Each year from 2017-2019, she was named one of the most powerful women in cable by Cablefax.

Kim is a graduate of Georgia Institute of Technology. She is a member of several industry associations and boards including Alliance for Telecommunications Industry Solutions (ATIS) and the FCC Communications Security, Reliability and Interoperability Council V. She is active in volunteer organizations including Children’s Healthcare of Atlanta Technology Advisory Board and support of homeless shelters located in Atlanta.

Show Highlights:

There has been an increased demand for security insights since 2014 because of large company security breaches.
Leaders started looking for an increase in security insights out of worry and wanted to know: what happened, how did it happen, and could it happen to us?
How do you talk to leaders about security without scaring them?
We talk about security with a risk based approach:
- Call out the highest risks first.
- Do a little bit at a time.
- Give them context.
- Give them a comparison so they can better understand where the risks are.
There are two types of CISO’s:
- High tech.
- Business focused.
The ability to explain the technology in a business context and alert companies to what the risks are is important because it’s the most effective way to help CISO’s operate. Companies will be more likely to get buy-in and senior leaders will feel more comfortable with the security team.
How do you understand the magnitude of what to keep a watch on?
There are different areas in which data breaches are happening:
- Bad Guys.
- Nation State Actors.
- Hack-tivists.
When you start talking about security and risk, you run the risk of making companies look bad as far as their security of data goes.
Don’t let your vulnerability be because of funding. How can you partner with other departments or organizations to get the funding needed to reduce the risks and fix the issues early on?
Don’t bombard your listeners with too much detail, give them the facts but don’t overwhelm them.
Train your employees on effective communication, and continue to practice it.
Be sensitive of the information you share.
Help clear up misunderstandings or potential misunderstandings.
When you speak about complex things, you may need to say them multiple times and tell them in different ways in order for listeners to fully understand and remember.
The security team is trying to educate the entire organization, more than just talking about security risks.
Hands on experiences have helped prove the need for heightened security. Finding ways to make security fun and interesting tends to help the content resonate with people.
A strong leader is someone that employees are willing to follow.
As a leader, hire people who are smarter than you and have diversity of thought, those who are independent in their work and want to do the right thing.
Give employees opportunities to keep them engaged, allow people to own their own space, and let them grow in their career.
Keep your employee’s best interest in mind, and always keep an open dialogue.
Security is a great field to get into. Having a background in technology helps, and this career is in high demand and won’t go away.
Be willing to gently show people that they may not be doing enough in one area.

Communicate Cybersecurity Risk to Executives: How Security Leaders Turn Data Into Business Insight

Security teams have more information available than most audiences can absorb. Dashboards, incident reports, threat assessments and performance metrics may all be valuable internally, but presenting more data does not always create greater understanding.

To communicate cybersecurity risk to executives, security leaders must decide what the data means before deciding how much of it to share.

Executives need a focused view of the organization’s exposure, readiness and priorities. They need to understand what has changed, why it matters and whether a decision or investment is required. The security leader’s role is to turn complex information into insight that supports those conversations.

Communicate Cybersecurity Risk to Executives: Begin With the Question Leaders Need Answered

Before selecting data, identify the business question behind the conversation.

Leadership may want to know whether the organization is prepared for a particular risk, whether existing investments are producing results or whether a vulnerability could disrupt an important business priority. Starting with that question helps the security team choose information that supports the discussion.

Without a clear question, cybersecurity communication can become a tour of the security function. The audience hears about programs, tools and activity but may not understand the conclusion.

Begin with the answer. Then use the data to support it. That makes all the difference when it comes to being able to communicate cybersecurity risk to executives.

Communicate Cybersecurity Risk to Executives: Put Security Data Into Context

A number becomes meaningful when the audience can interpret it. That is why it is so important to know how to communicate cybersecurity risk to executives.

If a security leader reports an increase in detected threats, executives need to know whether the increase reflects greater exposure, stronger detection or a change in the broader environment. If a dashboard shows progress against a security initiative, the audience needs to understand how that progress affects the organization’s risk.

Context may include:

A comparison with an earlier reporting period
Progress against an established objective
The business operations or information affected
The potential financial, regulatory or reputational impact
The organization’s ability to respond and recover
The action being taken to reduce the risk

Context helps executives understand the significance of the data without requiring them to become cybersecurity experts.

Communicate Cybersecurity Risk to Executives: Move From Reporting Activity to Explaining Impact

Security teams often measure activity because activity is visible. They can count assessments, alerts, training completions and vulnerabilities. Those measurements may be important, but executives are more interested in what the activity accomplishes.

Rather than listing everything the team completed, explain what changed as a result.

Did the organization reduce a significant exposure? Did it improve its ability to identify an incident? Did a new process shorten response time? Did employee training address a recurring source of risk?

This shift moves the conversation from what the security team does to the value the security team creates.

It also helps security leaders communicate recommendations. When executives understand the connection between an initiative and a business outcome, they can evaluate funding and priorities more effectively.

Communicate Cybersecurity Risk to Executives: Use Comparisons to Make Risk Easier to Understand

Complex information becomes more accessible when listeners have a useful point of comparison.

A security leader might compare current risk with the organization’s prior position, an established objective or the level of exposure leadership has agreed to accept. The comparison should clarify the issue rather than introduce another layer of technical detail.

Comparisons are particularly useful when a risk cannot be eliminated completely. They allow the security leader to explain how much exposure remains, what controls are in place and whether additional action is warranted.

The goal is not to create unnecessary alarm. It is to give leaders enough perspective to make an informed decision.

Communicate Cybersecurity Risk to Executives: Cybersecurity Communication Is a Team Capability

The CISO may lead executive and Board conversations, but communication should not rest with one person.

Security professionals throughout the organization communicate cybersecurity risk with employees, business partners and leaders in other functions. They explain policies, respond to questions, address risky behavior and build support for security priorities. Each interaction influences how the organization understands and responds to cybersecurity risk.

That makes communication a capability that should be developed across the security team.

Team members need to organize technical information, that is on point when it comes to the ability to communicate cybersecurity risk, adjust to different levels of knowledge and explain what they need from the listener. They also need to recognize when a message is creating confusion, resistance or unnecessary fear.

The fundamentals of being able to communicate cybersecurity risk are consistent with SW&A’s Content, Style and Situation methodology. Security professionals must determine what the audience needs to know, deliver the message with credibility and adapt their approach to the specific conversation.

For some teams, development may focus on explaining data to executives. Others may need support building storylines, leading difficult conversations or responding to questions without losing the central message, especially when it comes to the need to communicate cybersecurity risk.

SW&A works with technology and security leaders on how to communicate cybersecurity risk to executives through executive coaching, communication consulting and tailored development for IT and engineering leaders.

Like what you hear? Hear more episodes about how to communicate cybersecurity risk to executives and other hot topics on the What’s Your Story podcast page!