How risk communication builds or erodes trust

The paradox has long been visible: cybersecurity is on board agendas, budgets are rising, and regulation is making senior management personally accountable. Yet security leaders regularly report that warnings are relativized, deferred, or treated as technical detail. The problem is often not a lack of cyber knowledge at executive level. Above all, it is a translation problem between two professional languages: security teams talk about vulnerabilities, controls, attack surfaces, CVEs, protection needs, and the security objectives of confidentiality, integrity and availability. Executive management, by contrast, makes decisions about earnings, cash flow, delivery capability, capital employed, liability, growth, and strategic room for action.

The central thesis is therefore this: a CISO does not become more persuasive by stating technical risks more loudly. A CISO is heard when cyber threats are translated into concrete risk scenarios and their uncertain effects on business objectives are made transparent. Ideally, the argument does not end with "high risk", but with a decision-ready range: What can happen? How often? Which financial and operational consequences are plausible? What does reducing the risk cost – and by how much does the exposure decline?

A Credibility Gap in the Boardroom

The Trend Micro study "The CISO Credibility Gap", published in 2024, is particularly relevant to this debate. Sapio Research surveyed around 2,600 IT security leaders in February 2024 from companies of different sizes and sectors across Europe, North and Latin America, the Middle East, and the Asia-Pacific region; 100 respondents were based in Germany. The findings are striking: globally, 79 percent said they had already experienced pressure from senior management to downplay the severity of cyber risks. Among those affected, 43 percent attributed this to being perceived as repetitive or "nagging", 42 percent to an image of being too negative, and 33 percent reported that their assessment had simply been dismissed.

The second part of the study is decisive. Forty-six percent said their credibility increased as soon as they were able to measure the business value of their cybersecurity strategy. Other reported effects included greater responsibility, higher appreciation of the function, more budget, and stronger involvement in decision-making. At the same time, only 54 percent were convinced that the C-suite fully understood the company's cyber risks; 34 percent said cybersecurity was still treated as part of IT risk rather than as business risk. The German publication also reports for the global dataset that 41 percent believed only a serious incident within their own organization would prompt leadership to take more decisive action.Fig. 01: The CISO credibility gap in numbers [Own illustration based on Trend Micro (2024)]

These figures do not prove causality. They are self-reports by security leaders in a study commissioned by a cybersecurity vendor. This is methodologically important: people who feel unheard may assess the causes differently from executive management. Even so, the pattern is difficult to ignore because the strongest positive finding is directly linked to translating cybersecurity into business value. In addition, 58 percent of global respondents said they needed to improve their communication skills.

The Picture Is Consistent – but Not Unambiguous

Several studies support the thesis that there is a friction zone between security and senior leadership. FTI Consulting surveyed 165 CISOs or security leaders in the United States in 2022. Fifty-eight percent said they had difficulty communicating technical information and cyber risks in a way that boards and senior leadership could understand; 91 percent considered communication coaching potentially helpful. IANS Research and Artico Search reached a governance finding in their "State of the CISO 2023 – 2024" survey of 663 CISOs: 85 percent believed the board should provide clear guardrails on risk tolerance, but only 36 percent felt that this actually happened.

The picture of cyber competence at board level is also mixed. In Heidrick & Struggles' 2023 global CISO study, only around 48 percent of respondents rated their board's knowledge or expertise as sufficient "mostly" or "to a large extent" to respond effectively to cyber presentations. PwC, in its Global Digital Trust Insights 2025, found a perception gap between functions: 66 percent of technology leaders named cyber as a top risk for mitigation, compared with only 48 percent of business leaders.
At the same time, it would be wrong to claim a universal crisis in board-CISO relations. An executive can consider cybersecurity important and still find a specific proposal difficult to act on when it does not make exposure, alternative courses of action, or financial impact visible.

Why CISOs Aren't Heard: The Seven Structural Causes

1. Attention Is Not Relevance

Cybersecurity has reached the agenda. That does not mean the communication problem has been solved. Executives must prioritize between investments from competing areas. Statements such as "ransomware remains critical" or "availability requires very high protection" describe a condition, but not yet a decision. They answer neither which business objective is threatened nor how large the exposure is relative to other risks. In the boardroom, the CISO is not competing with another security report, but with investments in sales, production, M&A, people, working capital, or product development.

2. Technical Abstraction Creates Distance

The classic security objectives of confidentiality, integrity and availability are indispensable for structuring information security systematically. For decision-makers, however, they remain abstract if the link to the business process is missing. "Availability critical" can mean that an internal knowledge base is unavailable for four hours. But it can also mean that a production line is down for five days, committed delivery dates are missed, and a major customer gains a contractual right to terminate. The same security label can conceal economically very different situations.

3. Threats Are Confused with Risks

A particularly consequential language problem is the conflation of threat and risk. NIST defines a threat as a circumstance or event with the potential to adversely affect organizations or systems. Risk, by contrast, is typically a function of potential adverse impact and likelihood or frequency. "Ransomware", "phishing", "DDoS", or "insider" are therefore initially threats or threat events—not concrete risks.

In many risk registers, such terms are nevertheless used as risk entries because the terminology is applied imprecisely. Anyone who records "ransomware = high risk" skips the question of which critical processes are affected and which impacts and business "pain" can result.Fig. 02: Threat, vulnerability, risk scenario and business impact are distinct layers [Own illustration based on NIST risk definitions and the logic of scenario-based risk analysis]

4. Asset-Based Analysis: When the Trees Hide the Forest

Another reason for the communication gap lies in the architecture of many security and GRC programs. They start with assets: servers, applications, databases, interfaces, identities, cloud resources, endpoints, backups, and network zones. For operations, hardening, vulnerability management, and auditability, this view is indispensable. At its core, it often resembles fault-tree analysis (FTA): starting from an undesirable technical top event and working backwards to causes, vulnerabilities, control failures, and dependencies. This is methodologically useful because it makes causal chains visible and enables concrete measures to be derived.

The approach becomes problematic when it turns into the dominant form of risk thinking. Organizations then generate hundreds or thousands of asset findings, control gaps, and protection needs, all of which appear plausibly important. Local weaknesses are optimized while the view of the few business-critical scenarios is lost. The result is a paradoxical information overload: the more precise the asset map becomes, the harder it can be to identify the truly decisive risks. The organization sees the trees—patch levels, CVSS scores, IAM exceptions, backup gaps – but no longer the forest: Which process chain can fail? What customer or liquidity impact follows? Which exposure exceeds the risk appetite?

A risk-oriented approach therefore does not start with the completeness of all assets, but with critical business objectives and processes. It asks: Which few scenarios can materially impair earnings, cash flow, delivery capability, reputation, or regulatory ability to act? Which technical causes drive these scenarios? Which controls reduce event frequency, propagation, or loss magnitude? The asset view is not replaced, but placed in context. Assets provide evidence and causes; the risk scenario provides priority and decision logic.

For decision-makers, this distinction is central. A board cannot meaningfully vote on 700 findings. It can, however, decide on five material risk scenarios, each with exposure, mitigation options, residual exposure, and a link to risk appetite. The key is not to jump from the asset catalogue directly to a remediation list, but to formulate the critical middle layer: the plausible, business-relevant risk scenario.

5. The Heatmap Trap

Heatmaps are popular because they compress complex information quickly. That is precisely where their weakness lies. Two scenarios can both be "red" even though one has a 20 percent annual probability of causing a €500,000 loss while the other has a 2 percent probability of causing a €40 million loss. For budgeting, insurance, liquidity planning, or decisions about process redundancy, these cases are not interchangeable.

Financial quantification, however, must not turn into false precision. Nobody knows the "true" probability of a targeted cyberattack to two decimal places. Good quantification therefore works with ranges, scenarios, and distributions. It separates frequency from loss magnitude, makes assumptions transparent, and shows sensitivities. The value does not lie in a magical exact number, but in a common language for uncertainty. NIST explicitly recommends in its IR 8286 series integrating cyber risks into Enterprise Risk Management and using Business Impact Analysis to quantify organizational and enterprise-wide consequences. Open FAIR follows the same basic idea with a standardized taxonomy and financial risk measurement.

Fig. 03: A qualitative matrix and a probabilistic loss distribution answer different questions [Own illustrative representation; the loss values are fictional. For the academic critique of risk matrices, see Cox (2008) and Gleißner/Romeike (2011)]

6. Translation into Executive Language

The demand to speak the "language of business" can itself become a cliché. In practice, it means connecting the technical causal chain to the organization's steering variables. Appropriate target metrics depend on the business model. In an industrial company, downtime, output, contribution margin per production day, OEE, contractual penalties, and working capital may dominate. In e-commerce, revenue per hour, conversion, chargebacks, and customer churn are more relevant. Financial services add regulatory capital and compliance effects; in healthcare, patient safety and continuity of care may matter more than short-term margin.

Typical financial and business KPIs for cyber risk scenarios include revenue and lost revenue, contribution margin, EBIT/EBITDA, operating cash flow, working capital, recovery and forensic costs, contractual penalties, legal and notification costs, insurance deductibles, customer churn, market share, production volume, and – depending on the sector – safety and compliance indicators. Not every effect has to be monetized. But every material effect should be linked to an enterprise objective.

Technical version: "Ransomware risk high. ERP availability critical. MFA coverage 82 percent. Several findings with high CVSS scores." For a security team, this statement is useful because it signals technical areas for action. For an investment committee, however, the basis for comparison is missing.

Board-ready version – explicitly only as an illustrative example: "A privileged account can be compromised through phishing or session theft. In a plausible scenario, ERP and adjacent production systems are disrupted for three to seven days. Order entry, production planning, and shipping are affected. The loss arises from lost contribution margin, expedited costs, restart activities, forensics, and possible contractual penalties. For the current state, we estimate annual scenario frequency as a range and model loss magnitude as a distribution. Investment in phishing-resistant MFA, Privileged Access Management, and segmentation primarily reduces frequency and propagation. The board is asked to decide between three options: accept the existing risk, fund the control package, or transfer part of the exposure through insurance or contractual arrangements."

The difference is fundamental: the second version does not require a leap of faith about how dangerous ransomware is. It makes assumptions transparent, identifies the affected value driver, makes alternatives comparable, and forces security and the business to decide jointly on risk acceptance.

7. The Gap Is Bidirectional

It would be too simplistic to diagnose the communication gap as a communication deficit on the part of CISOs. The IANS/Artico data point in the other direction as well: the majority of CISOs want boards to provide clear guardrails on risk tolerance, but only 36 percent believe this actually happens. Without a defined risk appetite, a CISO can hardly determine whether an exposure is "too high". Security then inevitably becomes normative: "This has to be made safer." Executive management, however, must define which interruptions, losses, regulatory consequences, or safety risks it can accept – and which it cannot.

Reporting lines and role design also matter. If the CISO is perceived exclusively as a technical operating-cost function, every security request can easily be interpreted as a budget interest. Closer integration with Enterprise Risk Management, CFO/CRO functions, business process owners, and Internal Audit can improve the quality of the risk statement. NIST CSF 2.0 explicitly strengthened the "Govern" function and describes cybersecurity as a source of enterprise risk that should be managed in the context of other risks.

Summary and Outlook

Why are CISOs not heard? Because too many cyber messages stop at the wrong level of abstraction. A threat is not yet a risk. A protection need is not yet a business impact. A red heatmap is not yet an investment decision. And a technical KPI is not yet a measure of enterprise exposure.

The communication gap can only be closed if both sides change their role. CISOs must build risk scenarios, quantify uncertainty, and link consequences to business and financial KPIs. Boards must define risk appetite and tolerances, integrate cybersecurity into Enterprise Risk Management, and explicitly take ownership of decisions about residual exposure. The CISO of the future is therefore not less technical – but bilingual: fluent in attack chains and business models, controls and cash flow, recovery time and contribution margin.

The next stage of development is not an even more colorful dashboard. It is shared risk modeling that connects technical evidence, process dependencies, and economic impacts. Quantitative methods, Business Impact Analysis, and simulation-based loss distributions can help. Governance remains decisive: good numbers do not replace responsibility, but they make responsibility decision-ready.

References:

• Cox, L. A. Jr. (2008). What's Wrong with Risk Matrices? Risk Analysis, 28(2), 497–512. DOI: 10.1111/j.1539-6924.2008.01030.x. Link
• FTI Consulting (2022). Survey Reveals CISOs Struggle to Effectively Articulate the Business Impact of Cyber Risks. Survey of 165 U.S. CISOs/security leaders. Link
• Gleißner, W. / Romeike, F. (2011): Die größte anzunehmende Dummheit im Risikomanagement - Berechnung der Summe von Schadenserwartungswerten als Maß für den Gesamtrisikoumfang [The Biggest Mistake in Risk Management—Calculating the Sum of Expected Loss Values as a Measure of Overall Risk Exposure], in: Risk, Compliance & Audit (RC&A), 01/2011, p. 21-26. Link
• Heidrick & Struggles (2023). Global Chief Information Security Officer (CISO) Survey. Link
• IANS Research & Artico Search (2024). State of the CISO 2023–2024. 663 CISO responses; board engagement and risk-tolerance findings. Link
• NIST Computer Security Resource Center. Glossary: Threat. Link
• NIST Computer Security Resource Center. Glossary: Risk. Link
• NIST (2024). The NIST Cybersecurity Framework (CSF) 2.0. Link
• NIST (2025). IR 8286A Rev. 1: Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management. Link
• NIST (2025). IR 8286D: Using Business Impact Analysis to Inform Risk Prioritization and Response. Link
• Proofpoint (2024). Voice of the CISO 2024. 1,600 CISOs in 16 countries. Link
• PwC (2024/2025). 2025 Global Digital Trust Insights. 4,042 business and technology executives in 77 countries. Link
• The Open Group. Open FAIR Body of Knowledge – Risk Analysis and Risk Taxonomy. Link
• Trend Micro (2024). IT Security Leaders Are Failing to Close a Boardroom Credibility Gap. Global press release / study findings. Link
• Trend Micro Deutschland (2024). IT-Security-Verantwortliche scheitern an der Kommunikation mit der Geschäftsleitung. Enthält Methodik und deutsche/global vergleichende Angaben. Link
• World Economic Forum (2025): Global Cybersecurity Outlook 2025 – The evolution of the CISO role. Link