# Communicating Cyber Risk: Why Soft Skills Are Now Security Skills Dr. Ashley Sweetman explains how translating technical risk into business terms builds organizational resilience. - **Source:** [ISF Podcast](https://brifing.si/source/79b0fddc-4e90-46d5-ae51-4389c80ea5c7) - **Published:** 2026-10-20 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/642b37c8-0cfb-4611-b00c-f96624bc391a ## Bridging Technical and Business Domains Dr. Ashley Sweetman emphasizes that cybersecurity professionals must translate complex technical risks into financial and business language. By framing threats in terms of real-world impact on customers and clients, security teams gain credibility. This shift requires moving away from jargon toward estimative intelligence language that executives can easily understand and act upon. ## The Strategic Value of Empathy Soft skills like empathy and honesty are increasingly viewed by C-suite executives as essential components of a security professional's toolkit. These interpersonal abilities enable better collaboration across departments, which is vital for building cyber resilience. Technical expertise alone is no longer sufficient for leaders tasked with managing organizational risk in modern environments. ## Cultivating a Security-Focused Culture A security-focused culture is established through consistent leadership and the active promotion of transparency. When leaders prioritize cybersecurity, it sets a standard for the entire organization. This cultural foundation ensures that security is not treated as an isolated IT function but as a shared responsibility integrated into daily business operations. ## Building Boardroom Trust and Credibility Effective communication with the board requires pre-existing relationships built on long-term trust. When a crisis occurs, established credibility allows the board to challenge security strategies constructively rather than reactively. This preparation ensures that all stakeholders understand their specific roles and responsibilities before the organization faces an inevitable security incident or breach. ## AI as a Constructive Challenger While AI is not yet reliable for producing primary communications, it serves as a useful tool for peer comparison and generating constructive challenge questions. Security teams can leverage these AI capabilities to stress-test their messaging and identify potential gaps in their risk assessments before presenting them to senior leadership or the board. ## The Necessity of Communication Training Cybersecurity employees require specialized communications training to effectively articulate risk to non-technical stakeholders. This training helps bridge the gap between technical reality and business strategy. By investing in these skills, organizations ensure that their security teams can influence decision-making processes and secure the necessary resources to mitigate emerging threats effectively. ## Tailoring Messages for Stakeholders Successful risk communication depends on understanding the specific audience and tailoring the message accordingly. Transparency remains a core principle, but the delivery must align with the priorities of the recipient. This targeted approach ensures that the information provided is relevant, actionable, and capable of driving the desired organizational security outcomes. ## Resilience Through Proactive Engagement Cyber resilience is ultimately a product of ongoing engagement rather than sporadic reporting. By fostering relationships between security teams and other business units, organizations create a more robust defense posture. This proactive stance ensures that when crises arise, the organization is equipped with the right skills and questions to respond effectively. ## Sources covering this story - https://audioboom.com/posts/8964828 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._