A funding request that opens with a technical description of a vulnerability is competing, in the same budget cycle, against a request for a new product line or a market expansion — each described entirely in terms of return and risk to the business. It is not a fair fight, and it is not a fight the technical framing was ever going to win.The Translation That Has to HappenA board makes investment decisions by comparing options in a shared unit: expected cost against expected consequence. A security investment case has to be built the same way — not because the underlying technical work changes, but because the decision-maker's frame does not change to meet the request halfway.Building the Case in the Board's TermsName the scenario the spend prevents: in business language — a service disrupted, a customer data obligation missed — not a description of the underlying flaw.State the current exposure honestly: including the uncomfortable case for doing nothing, which is itself a decision the board is implicitly making by not funding the request.Compare against what else the same money could buy: a board weighing trade-offs benefits from seeing the request sit alongside its real alternatives, not in isolation.State what changes if it is only partially funded: an all-or-nothing ask is easy to defer entirely; a scoped version with a clear reduction in coverage often is not.“A board will fund the risk it can see priced. It will defer, indefinitely, the risk it can only see described.”Why This Is a Leadership Skill, Not a Reporting TemplateNo template does this translation automatically, because it requires judgment about which scenario is the one worth naming and which detail is noise. That judgment is what separates a CISO whose funding requests keep getting approved from one whose requests keep getting deferred for 'more information' — the information was rarely the real gap. The frame was.Share this articleX (Twitter)LinkedInFacebookCopy Link
Executive ReportingJun 23, 2026The Metric That Tells the Board NothingA patch-compliance percentage, reported the same way every quarter, tells the board almost nothing about whether the organization is more or less exposed than it was.
Board AlignmentAug 11, 2026Getting the Board to Treat Cyber Risk as Business RiskMost boards already have a rigorous process for weighing financial and market risk. Cyber risk usually sits outside it, reviewed on its own schedule, in its own language.
CISO LeadershipAug 25, 2026The CISO as Strategic Enabler, Not BlockerThe CISOs a board trusts most are rarely the ones who say no fastest. They are the ones who can say yes, on the record, to the risk a decision actually carries.
