In her session at ISC2 Security Congress 2026, May Brooks-Kempler, CISSP, HCISPP, CEO and founder at Helena Security, spoke about shifting the conversation away from “The sky is falling!” and towards the ways good cybersecurity practices align with business objectives.
Disclaimer: The views and opinions expressed in this article belong solely to the author and do not necessarily reflect those of ISC2.
It’s long been a tactic of cybersecurity professionals to use the language of fear (Ransomware threats! Penalties! Data breaches!) to spur business leaders into investing in cybersecurity staff and defenses. But while fear can be a great motivator, when very little or nothing happens—either because the defenses worked, the organization wasn’t targeted, or the attack didn’t cause damage—it loses its effectiveness. So, what can we do to convince people to take cybersecurity seriously? Learn a different language.
When the Sky Doesn’t Fall
May Brooks-Kempler told a story from early in her cybersecurity career. She worked for an insurance company that was hit with a ransomware attack by a hacktivist group that threatened to damage the company’s reputation and humiliate the country where it did business. She warned the owner that the results could be catastrophic if they didn’t pay: their clients would leave, the company would fail, etc. But the owner disagreed. He’d been in business long enough to have developed deep relationships with his clients and was confident that no harm would come to it if he didn’t pay the ransom. After the demands for payment were ignored, the hacktivists published all of the communications between themselves and the company, believing they’d destroyed its image beyond repair.
It turns out that the owner had been right. None of his clients deserted the firm. After a while it was business as usual again.
We often hype fear to get attention. But when nothing happens, the urgency vanishes. Therefore, we need to change the way we communicate.
Cybersecurity professionals often say they want to be partners in an organization’s operations. Not the gatekeepers, not the people who say “no” all the time. But that doesn’t happen unless you understand what the organization’s priorities are and learn to speak its language.
A technically accurate explanation can still fail as communication. Sending more data, adding more acronyms or describing controls in greater detail does not guarantee that an executive audience will see why a proposal matters. Effective communication begins with the listener: what they are responsible for, what they are trying to achieve and what trade-offs they must manage.
That shift changes the dynamic of a leadership conversation. As a cybersecurity professional, your goal shouldn’t be to make executives understand cybersecurity. Instead, you need to give them the information they need to help them make better decisions. To do this, your language needs to be understandable, jargon free and relatable. You also need to learn what’s important to your audience.
Five Ways Cybersecurity Creates Business Value
Leadership attention is often shaped by immediate concerns like risk, compliance and cost. Security can speak to those concerns while also showing a broader contribution to organizational performance. Five dimensions provide a practical way to frame that value:
These dimensions invite security teams to move beyond activity reporting. The number of assessments completed, vulnerabilities closed or alerts investigated may be useful operational measures, but leadership support grows when those activities are tied to outcomes the business recognizes.
Not all five dimensions need to be included in every security control conversation. As you continue to listen to your audience, you’ll come to learn which ones to focus on and when.
Prepare for the Audience Before Building the Message
A persuasive leadership conversation starts before the meeting. Three questions can sharpen the message:
- Whom am I addressing? Consider the audience’s responsibilities, priorities and level of technical familiarity.
- What do I want to happen? Define the decision, commitment or action required.
- Why should they care? Connect the issue to an outcome or exposure that matters in their role.
This preparation prevents a common mistake: leading with the control rather than the business need. A request framed around a product, standard or technical gap asks leaders to connect the dots themselves. A stronger approach begins with the outcome the organization needs and then explains the security contribution.
Deliver a Clear Problem, Relevance and Ask
Once the audience and objective are clear, the delivery can be organized around three elements:
- Problem: What is happening? State the issue plainly and at the right level of detail.
- Relevance: Why does it matter to this audience? Explain the connection to business priorities and consequences.
- Ask: What is needed from leadership? Make the requested decision, funding or sponsorship explicit.
Consider multifactor authentication. “We need MFA because it reduces risk” is accurate, but generic. “MFA will protect customer access, reduce account compromise and support secure growth” tells a more complete story. The control hasn’t changed and the second version makes its business purpose visible.
Make the Evidence Match the Claim
A business-oriented message still requires rigor. If a proposal claims that a control will reduce downtime, accelerate product delivery or protect customer access, the evidence should show that the outcome was achieved or provide a reasonable indication of it. Security metrics should support the story rather than sit beside it without a clear connection.
It’s how you become a credible partner to the organization. Leaders are more likely to support an investment when the proposed benefit is concrete, the assumptions are visible and the result can be evaluated. Useful metrics might include downtime, recovery time, time to market, customer churn, revenue exposure or cost per transaction. There’s no one-size-fits-all metric; it depends on the organization and the decision at hand.
Putting It into Practice
Changing the relationship between cybersecurity and organization leaders doesn’t require a new reporting system or a sweeping transformation. It can begin with three small practices:
- Ask one business-centric question before asking a cybersecurity question. Start with, “What are we trying to achieve?”
- Rewrite one security request in business language. Move from “we need MFA” to “we need to protect customer access.”
- Learn one number the organization cares about, such as revenue, churn, downtime, time to market or cost per transaction.
Becoming a Partner to the Organization
Fear can make cybersecurity visible but doesn’t help you to develop partnerships. You earn leadership support by showing that you understand the business, connecting capabilities to meaningful outcomes and providing evidence that makes those outcomes believable.
It’s not always easy to translate what your experience tells you is the best course of action into persuasive conversations that drive results. But taking the time to understand your audience, their organization and their goals can help you to develop the relationships and engender the trust needed to become a true organization partner.
Learn more about ISC2 Security Congress 2026 Sessions
Virtual and in-person attendees to Congress can see an on-demand replay of the session this article is based on as part of their existing access. On-demand access packages for Congress sessions will be available at a later date.
