Communicating Cyber Risk: Why Soft Skills Are Now Security Skills
Dr. Ashley Sweetman explains how translating technical risk into business terms builds organizational resilience.
1Bridging Technical and Business Domains
Dr. Ashley Sweetman emphasizes that cybersecurity professionals must translate complex technical risks into financial and business language. By framing threats in terms of real-world impact on customers and clients, security teams gain credibility. This shift requires moving away from jargon toward estimative intelligence language that executives can easily understand and act upon.
2The Strategic Value of Empathy
Soft skills like empathy and honesty are increasingly viewed by C-suite executives as essential components of a security professional's toolkit. These interpersonal abilities enable better collaboration across departments, which is vital for building cyber resilience. Technical expertise alone is no longer sufficient for leaders tasked with managing organizational risk in modern environments.
3Cultivating a Security-Focused Culture
A security-focused culture is established through consistent leadership and the active promotion of transparency. When leaders prioritize cybersecurity, it sets a standard for the entire organization. This cultural foundation ensures that security is not treated as an isolated IT function but as a shared responsibility integrated into daily business operations.
4Building Boardroom Trust and Credibility
Effective communication with the board requires pre-existing relationships built on long-term trust. When a crisis occurs, established credibility allows the board to challenge security strategies constructively rather than reactively. This preparation ensures that all stakeholders understand their specific roles and responsibilities before the organization faces an inevitable security incident or breach.
5AI as a Constructive Challenger
While AI is not yet reliable for producing primary communications, it serves as a useful tool for peer comparison and generating constructive challenge questions. Security teams can leverage these AI capabilities to stress-test their messaging and identify potential gaps in their risk assessments before presenting them to senior leadership or the board.
6The Necessity of Communication Training
Cybersecurity employees require specialized communications training to effectively articulate risk to non-technical stakeholders. This training helps bridge the gap between technical reality and business strategy. By investing in these skills, organizations ensure that their security teams can influence decision-making processes and secure the necessary resources to mitigate emerging threats effectively.
7Tailoring Messages for Stakeholders
Successful risk communication depends on understanding the specific audience and tailoring the message accordingly. Transparency remains a core principle, but the delivery must align with the priorities of the recipient. This targeted approach ensures that the information provided is relevant, actionable, and capable of driving the desired organizational security outcomes.
8Resilience Through Proactive Engagement
Cyber resilience is ultimately a product of ongoing engagement rather than sporadic reporting. By fostering relationships between security teams and other business units, organizations create a more robust defense posture. This proactive stance ensures that when crises arise, the organization is equipped with the right skills and questions to respond effectively.
Original article: ISF Podcast — Communicating Cyber Risk: Why Soft Skills Are Now Security Skills