Retour 
I have spent many years, perhaps too many, working in the world of IT and information security. I can’t complain, I have to say, it has been rewarding. And I have noticed in recent years that there has been a considerable shift in how cybersecurity is perceived within organizations, with this function gaining greater importance and relevance. The personal influence of the CISO has been improving lately, both in terms of attitude and perception. They are more involved in helping the organization, moving away from being seen as a “blocker” and becoming an agent of change, more frequently participating in business decisions, becoming more visible, and having a greater impact on the organization.
In short, cybersecurity is increasingly becoming a function aimed at balancing risk with opportunity and innovation, serving as an objective and impartial source of information that helps executives make better decisions while supporting the organization’s goals and challenges. Or at least that is what we aspire to achieve as professionals in this field.
Unfortunately, cybersecurity is still seen in many Boards or Executive Committees as a technical issue, something that should be handled at lower levels by truly specialized staff. Moreover, interest tends to fade quickly, especially if, as cybersecurity leaders, we fall into the trap of using too much “jargon” that they don’t really understand. They often feel unprepared for a cyberattack, despite stating that cybersecurity is a top priority. Conclusion: there is still plenty of room for improvement in the relationship between top management, cybersecurity and CISOs.
What is certain is that senior leadership can no longer avoid their responsibility when it comes to cybersecurity. We also know that information security measures are much more effective when they have the leadership support.
How can we get C-levels fully engaged in cybersecurity?
Cybersecurity is no longer purely an operational concern for organizations. It must be a radical mindset shift,moving away from a focus solely on compliance and perimeter/data security to emphasizing strategy and risk management. We need to cultivate behaviors that generate and promote the trust required by any organization in today’s digital world.
Board members and executive committees play a key role in shaping the culture and positioning of organizations concerning cybersecurity. However, they often lack a real comprehensive, self-assessment driven maturity model that can help them to self-assess their direct level of cybersecurity accountability.
Many executives still fail to grasp the strategic impact that cybersecurity risks can have on their companies. They need to understand the array of potential threats they face in today’s digital world. Most importantly, they must also grasp the strategies and specific plans required to combat those threats and to ensure their organizations are cyber-resilient. Senior executives should seek to turn their CISO into a strategic partner. With the unstoppable rise of cyber threats and risks, better alignment of priorities in this area will help strengthen the security, protection, and resilience of their organizations.
How to effectively communicate with C-level executives?
Here are some tips for engaging with C-level executives, based on my professional experience as a former CIO and CISO:
- Align your conversation with executives’ strategic priorities. It is imperative to understand the primary concerns of C-level executives: increasing revenue, optimizing operational efficiency, perhaps expanding into new markets or improving their reputation. Cybersecurity should be positioned as an enabler of these objectives—not just a protective measure or added cost but a strategic asset that can offer a distinct competitive advantage.
- Cyber risk impact. Help C-level executives understand and assess the risks of technology by emphasizing the potential damage a cybersecurity incident could cause on company operations. This extends beyond financial losses resulting from operational disruptions to include asset theft, customer data breaches and the legal and regulatory consequences due to third-party damages. Highlight the potential reputational harm, along with the substantial financial and administrative penalties that may result.
- Present real-life examples, especially from competitors. In my experience, real world examples can have a powerful impact in board meetings, helping capture their attention and effectively demonstrate and contextualize the importance of cybersecurity. Sharing examples of similar organizations that have suffered security breaches and the repercussions those incidents have had on their operations, reputation, and financial results, vividly illustrates the consequences of not taking cybersecurity seriously.
- Demonstrate the Return on Investment (ROI). Whenever possible, we need to present cybersecurity as a strategic investment that leads to a measurable return. This is the language executives best understand, translating cybersecurity’s value into financial terms. Tools like Valueskope, developed by Netskope, can help organizations assess and quantify the value of their security investments, especially in cloud security.
- Make resilience a mindset. When speaking to a board or executive committee, it is essential to always be prepared to respond to their concerns. Convince them that cybersecurity is not optional but a shared responsibility, especially as the highest authority. Persuade them that one of their greatest responsibilities today is to build “resilient businesses, that not only have the ability to recover but also adapt to constant changes and threats in the environment. Achieving this requires identifying and measuring unstable conditions and transforming threats into opportunities for growth and innovation.
- Foster a cybersecurity culture throughout their organization. Executives need to be reminded that buying and installing a tool for protection isn’t a magic solution, as the majority of cybersecurity incidents are related to human factors. Thus, they must be encouraged to promote cybersecurity training for all staff, starting with themselves.
- Reiterate the importance of integrating cybersecurity into the company’s business strategy and key processes. As digitization progresses, the reliance on technology grows and the cybercrime landscape becomes increasingly complex, with a higher likelihood of impact. Leaders across all areas must understand these realities and remain involved in continually adapting and improving their strategy and processes to meet this “new” paradigm.
- Consolidate cybersecurity as a regular agenda item. They should periodically have the opportunity to review security plans, formulate opinions and policies and discuss activities and solutions aimed at protecting the organization’s assets. It is essential to stay informed with specific, regular dedication that is proportional to the technological risk being undertaken.
- Budgeting. We often feel that cybersecurity investment falls short, while the problems to solve seem endless. It is crucial to help executive leaders prioritize based on the requirements and needs of their specific industry, and the most relevant threats that could cause the most harm to their organization. The most mature budgeting strategy is one based on the real risks the company faces, to identify the cost needed for mitigation. Although this sounds simple, it is actually quite difficult to execute. Using benchmarking reports that include average cybersecurity budgets by industry, company size and geography is a more accessible way to help.
- Executives must be familiar with data privacy regulations (such as GDPR and CCPA). One of the most prominent and significant risks is the potential violation of these regulations and the most alarming prospect for boards is the possibility of fines or penalties for non-compliance. The NIS2 directive, for example, introduces explicit requirements for leadership to assume greater responsibility for cybersecurity management within their organizations. Executives must ensure that cybersecurity risks are properly identified and effective measures are implemented to mitigate them. This involves establishing clear cybersecurity policies aligned with the organization’s goals and overall strategy. These policies should be regularly reviewed and updated to adapt to the changing threat landscape, all while ensuring compliance with reporting guidelines and proper communication within the organization and with relevant authorities.
- Communicate effectively, in a straightforward and simple manner. Everything I’ve covered in this blog must be communicated and explained in clear, concise, and non-technical language that they can understand. Whenever possible, use business language instead of technical terms. Additionally, strive to be diplomatic, clever, sincere, charismatic and authentic. The key to influence is to be consistent and coherent, focusing on information rather than technology. Build interpersonal bridges that help us gain credibility
To conclude this article, I would like to emphasize that developing and integrating a security culture involving senior leadership is one of the most challenging and complex goals to achieve. It requires significant time, with continuous actions over time to build and earn their trust and empathy. Convincing C-levels to internalize our proposals and messages, adopt and approve new methods of working around cybersecurity, is no easy task. Often, executives and other users view security policies and protocols as a burden, an inconvenience, or a cost. The general perception is that security is cumbersome and impedes day-to-day operations, imposing restrictions and slowing things down.
For this reason, it is imperative to reverse this negative perception. Cybersecurity must be transformed from an imposed obligation into a strategic advantage by creating a true cybersecurity culture that is understood and valued by everyone, especially the highest levels of the organization. This involves educating and clearly communicating to senior management the long-term benefits and demonstrating how cybersecurity not only protects the company’s assets but also serves as a key enabler for innovation and sustainable growth within organizations.
If you’d like to learn more about the kinds of conversations security CISO’s are having with their C-level and board counterparts, check out Netskope’s report, The Modern CISO: Bringing Balance
Lire le blog