5 Ways to Connect with Boards of Directors About Cybersecurity and Digital Transformation

In times of economic uncertainty, technology leaders have an opportunity to play an outsized role guiding businesses through the disruption. There is no better time to show how technology investments—whether in IT or physical security—can deliver on their promises of improved efficiency, productivity, and more secure, robust systems.

As security and technology leaders, you will need to present a business case of some sort to the board very soon (if you haven’t already), and it’s likely the board or C-suite members are not particularly “technical.”

So, how can you go about speaking to your company’s non-technical leaders? How can you make the best impression possible? How can you convince them that you—along with their technology investments—are a competitive advantage they can leverage to not only survive today’s challenges but also thrive?

To prepare for this inevitable discussion, consider these five best practices to ensure that you are presenting information that hits the mark.

It’s Not About You, It’s About the Business

The role of a board of directors is to see the company at a high level, encompassing all aspects of the business and its operations. Although sometimes they may deal with short-term goals (especially now), for the most part, the board is more focused on the future growth of the organization.

It is imperative that you understand this perspective and what they see as their objectives. Ask yourself some questions about the current issues the company faces. In 2021, things like growth, revenue, IT investments would have been top of mind. Today it’s more likely about cost reductions and efficiency. Risk management will shape the discussion, especially cybersecurity.

Technology leaders—whether they are in the physical security or cybersecurity space—understand how a solution makes sense for the entire business. But they shouldn’t assume that the members of the board will get it. In the instance of cybersecurity investments, do they really know it’s essential to the business? Or is it seen as just another cost?

Here’s an example: The board may have little interest in IT security or might be hesitant to make an investment in a tool such as multi-factor authentication (MFA) to strengthen cybersecurity across the entire organization. Your tactic in this instance should be to align the pitch with what their long-term goals are. In this case, the board may care about risk management, and if MFA is presented as a way to layer security and protect the business long-term, you might make more headway.

Business Value Rules Everything

“The last thing we think about is technology. Tech isn’t the process,” said one of our clients recently. Boards think about technology differently than line of business managers, and especially IT leaders. Investments in technology for them are about business outcomes.

Complexity isn’t something most board directors care about—and their eyes may glaze over when you mention the technical minutia of a security operations center, network segmentation, or firewall configuration. But they do care about the impact these investments have on the business’s growth and how not investing in these solutions could hurt the business in the long term.

For example, cybersecurity investments are about business continuity and risk mitigation. The latter is an insurance pitch (not one I like to make); the former is an operational stability guarantee (much more positive).

Helping the board make more effective decisions should be the goal of your presentation.

Ensure that your presentation focuses on delivering business outcomes—whatever that means for your company today. Can technology deliver improved productivity through workflow automation? Can data insights reduce costs and accelerate revenue growth? Take the conversation back to creating a competitive advantage through investing in technology that improves business process.

Use Language They Can Easily Understand

Presenting to the board of directors is not a time to prove you’re the smartest person in the room. (Although you likely are, in your area of domain expertise.)

When presenting technology solutions, explain concepts using language your audience can understand. Remove the geek speak and technical buzzwords.

Another thing to remember is to be brief in your explanations. Use storytelling to help illustrate important points that need to be conveyed. The result will be a better-informed group ready to vote in favor of your proposals.

Show, Don’t Tell

How do you make complex terms around, say, cybersecurity, ransomware, phishing attacks, and the threats of cybercriminals relatable? Use visuals to show complex ideas.

Let’s say the board or executives don’t see the value of MFA. The CEO says it’s too much hassle. Then illustrate how a single incident can become a business altering incident. For example, show the path from employee password theft (maybe the issue was re-used passwords between personal and work accounts), which is used to access an administrator account on the network, that directly links to physical security cameras. Showing that path visually can be powerful. It’s difficult to not understand.

In this instance, you can walk them through a scenario where cybercriminals gain access to the network and cryptolock the entire environment, along with the inevitable ransomware demand. Likely there are even public examples you can cite.

The amount of money demanded should be enough to illustrate your point, but there’s also the issue of impacted productivity when employees aren’t able to access their workstations or the applications they need to do their jobs. Or lost revenue when orders can’t be filled and are lost to competitors.

Show the how, the consequence, and only then how technology solves the problem.

Help Company Leaders Make Better Decisions

Part of the role of the board is to spend time building relationships in the community they operate in. Your job as a technology leader is to help them be better at it.

This means empowering them to talk about technology and how it affects the market they serve. The information you share often allows them to inform their opinion on a certain topic. In the instance of cybersecurity, this may help them realize the value that security can bring to their business partners, too.

Either way, I strongly recommend you approach your board presentations to help make them the hero in conversations that directly impact the business.

For better and worse, there is always opportunity chaos. Your job is to translate technical concepts into business benefits. Cybersecurity investments are a critical piece of the puzzle for many organizations, and your ability to focus on direct business impacts of these investments is the fastest path to everyone’s success.

Robert Collings is marketing director at ZAG Technical Services, an award-winning IT consulting firm and managed services provider based in San Jose, California; Boise, Idaho; and Salinas, California.