Businesses Run On Risk And Debt: Why Communicating Security Risk Is Hard
summary
Claim: executives hear resiliency and technical debt very differently than security people do, so budget requests fail. Concrete moves: translate CVEs and CVSS into a dollar-per-day loss estimate, use KEV/known‑exploit feeds and SCA/S3 checks to show exploitability, and present a simple balance‑scorecard view (biggest risk, action plan, percent done). Anecdotes of Uber and CircleCI supply specific failure modes and remediation costs that make the ask precise and fundable.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 1:03Security alerts and technical debt
- 3:10Why executives dismiss security
- 4:53Business resiliency and risk
- 6:40Risk from business perspective
- 9:08Practical risk analysis
- 10:30Reputational risk myths
- 12:18Evaluating security risks and fixes
- 14:03Technical debt metaphor problem
- 16:27How technical debt misunderstood
- 18:15Board resiliency demands
- 20:24Security cost center vs profit driver
- 21:49Board risk perspectives
- 23:11Cybersecurity board questions
- 24:39Balance scorecard for cyber resilience
- 27:28Criticisms of resilience scorecard
- 29:12Board presentation strategies
- 31:17Learning from security failures
- 33:462024 security incidents
- 34:50Communicating risk in executive terms
- 36:16Executives and resiliency storytelling
- 37:20Speaking audience language
- 38:25Departmental priorities
- 40:11Q&A: Quantifying risk financially
- 44:26Key takeaways
related talks
26mThe Risky Business of Risk Illiteracy (Sean Juroviesky)
28mHow to Tell the Right Cyber-Story to Executives and Board Members
40mGetting Cybersecurity Funding from Your CEO: the 5 Critical Steps
30mEffective security on a tight budget
15mTelling Hard Truths to Impact Change in Cybersecurity
45mThe Business Value of Security
51mYou Can't Measure Risk
16mSecurity Debt: What Lurks Beneath