The great disconnect between business and cybersecurity.

In April this year, I attended an ecommerce conference in Cape Town, South Africa. The conference was attended by just over a thousand delegates. The conference hall was packed as keynotes commenced. Starting with an overview of artificial intelligence, followed by a deep dive into the latest FinTech solutions. Just before the third keynote, on the topic of cybersecurity, about half of the delegates left the room. They either went to the expo or to get coffee. But they left the room.

From time to time, I encounter aspiring cybersecurity professionals. Many times, this is the theme of the conversation: I have been studying cybersecurity for the past 12+ months, I have been applying to X number of jobs, but I am not even getting an interview.

This was an interesting observation. It was not related to the speaker, because they left before the keynote started. In fact, it was a great talk. This begs the question; why would people leave when something as important as cybersecurity is about to be discussed? Could it be that they perceive cybersecurity to be an IT issue that does not impact them? Could it be that when cybersecurity professionals do have the opportunity to speak to business leaders, we mystify the topic and confuse them?
The truth is that not all cybersecurity professionals are natural storytellers. The inability to communicate complex things in a clear and concise manner with impact is a skill – not everyone can do it. A key challenge is that not all cybersecurity professionals understand the role of cybersecurity themselves, which is to support business objectives. Failing to communicate from a place of support and enablement will have limited impact; it will not resonate with business stakeholders.

Dumbing things down is a bad idea.

Below are practical tips to consider when engaging business leaders on the topic of cybersecurity:

1. Use relevant stories and examples

Stories and real-life case studies are powerful tools when communicating the importance of cybersecurity. However, the examples must be relatable and relevant to the audience.

2. Don’t be boring

Spreadsheets and risk matrices are boring. Find creative and innovative ways to communicate information. You are not limited by the SmartArt available in PowerPoint.

3. Keep it simple

Avoid big words, abbreviations, and complex terms. There is power in keeping it simple. Your audience will appreciate it.

The idea that we need to dumb things down for board members and business leaders is rooted in poor communication skills on the part of cybersecurity professionals. In most cases, when the audience fails to understand what we are trying to communicate, it says more about us, then about them.
Cyber is complex, but it can be explained in a manner that non-technical people can understand. Of all the unsolved problems in the world, explaining cyber to non-technical people is not one of those problems. Business leaders are generally smart and educated people. At the core, they care about and understand risk. Risk to the bottom line, risk to operations, and risk to the brand’s reputation. Cybersecurity is all about risk management. Our language is fundamentally the same… at least it should be.
As security leaders and practitioners, it is our responsibility to connect the dots between business and cybersecurity, and articulate the value of cybersecurity so clearly, that business users gravitate towards it. At the inception of new ideas, it should be a natural inclination for business leaders to invite the cybersecurity team to the table. When we come from a genuine place of wanting to enable and support the business, half the room will not leave the next time cybersecurity is on the agenda!