Atrás 
One chief information security officer (CISO) recently asked me how he should describe SASE (secure access service edge) and zero-trust networking to his company’s directors. My answer was easy: You shouldn’t.
As companies revamp their technology infrastructure to leverage cloud efficiencies and enable a remote workforce, cybersecurity is now mission-critical for senior executives and boards of directors. Ransomware, data theft, and other attacks are affecting an unprecedented number of businesses, and corporate boards are turning to their CISOs for assurances that their evolving infrastructure is adequately protected.
Many CISOs have to modify their techniques to effectively communicate with top executives. I’ve served as a CIO, CISO, and am currently the head of cloud strategy and innovation at Netskope, and also sit on three corporate boards. Because of this confluence of experiences, I often get questions from security leaders about how to explain their function and its key performance indicators to the C-suite, particularly the non-technical C-suite.
Most board members are not well-versed in the technical details of network or cybersecurity—frankly, they don’t need to be. The CISO’s job is to understand and manage the technologies required to keep the company’s data, employees, customers, and other stakeholders secure. What the board needs is confidence that the CISO knows what she’s doing and that she’s taking the right steps to protect corporate assets.
3 key strategies CISOs should consider:
1. Know your audience
A CISO preparing a presentation to the board must first understand who those board members are. There’s obviously variation in skillsets between organizations, but for the most part, directors are business leaders. They are responsible for high-level governance of the company’s product and service portfolio, cash flows and budgets, cost management, people, culture, and compliance matters, and they endorse the organization’s strategy. As important as cybersecurity is, there’s no way the board as a group is going to want to delve into the intricacies of building a zero-trust architecture.
A CISO who wants to educate the board on the importance of cybersecurity should instead focus the conversation on threats to the company’s strategy, threats to the customers, and the erosion of the value of their intellectual property (IP) due to a cyber attack. Looking at Netskope as an example, if our IP, engineering, or architectural designs were stolen, then the future value of our product would essentially walk out the door. A competitor could develop a product like ours, eliminate our competitive differentiation, and eventually siphon away revenue.
Cybersecurity failures present an existential risk to the organization’s survival. A conversation about this existential risk will get the full attention of any corporate board.
2. Identify and document the risks
CISOs are well-aware of the myriad ways in which two broad and recent trends — moving key corporate data into the cloud and enabling staff to work from anywhere — combine to increase the likelihood that an attack on the company will be successful. Business-critical workloads now reside in applications we didn’t write, networks we didn’t design, and we don’t necessarily have control or information about the devices employees and partners are using to connect to those applications.
In addition to the typical security mandate, security professionals are tasked with making sure everyone can access the resources they need to deliver business value, with as little friction as possible. These days, that goal requires a new way of thinking because the risk profile of corporate IT is far different