Today, Steve is in conversation with Dr. Ashley Sweetman, co-author with Nina Paine of the recently released book, Communicating Cyber Risk: Build Cyber Resilience Through Compelling Communication, including how to translate complex cyber risk into business and financial terms. Ash highlights the importance of empathy and honesty, and notes that more and more C-suite executives now consider these “soft” skills as important as technical skills. Ash and Steve also dive into how to communicate cyber risk to the board, what a security-focused culture is, and challenges created by AI. 

Key Takeaways:

  1. Lead with honesty and transparency, but make sure you understand who you are communicating to and tailor your message accordingly. 
  2. A leader that takes cybersecurity seriously goes a long way to build a security-focused culture.
  3. Cultivating relationships between the cybersecurity team and other teams is important for cyber resilience. 
Tune in to hear more about:
  1. Why more cybersecurity employees should receive communications training (4:48)
  2. What a security-focused culture looks like (9:24)
  3. Ash’s advice for communicating cyber risk that leaders can implement right now (20:37)
Standout Quotes:
  1. “Communicating things in business and financial terms is a pretty key skill. If you can put numbers on things and give talk in kind of estimative intelligence language, that can be helpful. It's about explaining things in terms of real world impact and the impact on the customer or your clients.” - Ash Sweetman
  2. “It's having those relationships with the board that preexist, the trust and credibility that you build up over time so that when the inevitable happens or if you're in a bit of a crisis period, everybody knows their roles. The board is able to challenge effectively. They're equipped with the right skills and questions to provide constructive challenge, and that is built over time rather than just when your back is against a wall.” - Ash Sweetman
  3. “I don't think anytime soon AI’s going to be relied upon as the kind of producer of communications, but I think it could do some good peer comparison, for example, or ask some really good constructive challenge questions and things like that.” - Ash Sweetman

Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter

From the Information Security Forum, the leading authority on cyber, information security, and risk management.