Episode 187: The Role of a CISO as a Strategic Storyteller
In episode 187 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager discuss how the role of a CISO functions as a strategic storyteller of cyber risk while keeping the bigger picture in mind.
Here are some highlights from our episode:
- 00:51. Framing the conversation around CISOs' efforts to communicate with the business
- 02:01. Translation: A nuanced practice of simplifying the story while still telling the truth
- 02:41. The need for a CISO to bridge their organization's respective "culture gap(s)"
- 04:13. Collaborative and dictatorial: Two different ways CISOs talk to a business
- 06:07. The work of translation in motivating and informing action around perceived risk
- 07:03. Security sampling: A story from Tony that reminds CISOs of the bigger picture
- 09:55. Fewer wizards and more mechanics: What the cybersecurity industry needs today
- 12:20. Two factors to consider: Politicking and the need to provide an accessible narrative
- 15:49. Rapport and tradecraft as two critical tools supporting the role of a CISO
- 18:09. Technical competence as a prerequisite for confidence in risk conversations
- 19:20. The false sense of security from relying on comparative data with competitors
- 22:14. The CISO as a strategic storyteller who helps the business make decisions
- 27:03. The need for machinery to constantly rediscover and recreate trust
- 30:15. A call to action for Boards: Build vernacular in cybersecurity risk space
- 35:03. CISO as a strategic storyteller vs. CISO as an enforcer
Resources
- CIS Critical Security Controls®
- CIS Community Defense Model 2.0
- Episode 183: The Role of CISO in Supporting Risk Translation
- Episode 166: Foundations of Actuarial Science in Cyber Risk
- Episode 121: The Economics of Cybersecurity Decision-Making
- NICE Workforce Framework for Cybersecurity (NICE Framework)
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].
As of June 23, 2025, the MS-ISAC has introduced a fee-based membership. Any potential reference to no-cost MS-ISAC services no longer applies.