Before the Breach: Translating Cyber Risk So It Stays on the C-Suite Agenda

About this video

• Video Title: Before the Breach: Translating Cyber Risk So It Stays on the C-Suite Agenda
• Channel: UC Today News
• Speakers: Christian McCann, Bill Dunion
• Duration: 00:13:39

Overview

This video discusses the persistent challenge of prioritizing cybersecurity within C-suite executive discussions. Host Christian McCann interviews Bill Dunion, CISO at Mitel, who explains why cybersecurity often takes a backseat to revenue and growth, how AI is exacerbating existing risks, and strategies for CISOs to effectively communicate cyber risk in business terms to secure a prominent place on the executive agenda.

Key takeaways

• C-Suite Priorities: Historically, C-suite leaders focus primarily on revenue, growth, and profit, which can cause essential operational items like cybersecurity to be deprioritized.
• AI and Risk: AI doesn't necessarily create new threats but significantly accelerates the exploitation of existing vulnerabilities at scale, impacting areas like R&D, IP protection, data loss, and privacy.
• The Wake-Up Call: Unfortunately, significant security incidents like ransomware or large breaches are often the catalysts that elevate cybersecurity to the top of the C-suite agenda. Leaders who have experienced such events tend to prioritize security more afterward.
• Translating Cyber Risk: To effectively communicate cyber risk, CISOs should view their role as a business leader, not just technical. Finding a mentor within the executive team, understanding sales language (e.g., using precise percentages for deal closure), and framing security in terms of supporting sales goals (like meeting customer security requirements for certifications) can bridge the gap.
• Aligned Security Culture: A truly aligned security culture involves open, continuous communication where security topics are integrated into regular meetings, not treated as an obligation. Employees should feel empowered to report anomalies without fear, and security should be as ubiquitous as logging into a laptop.