2025 - Joe Nay - Make Your Point

### Overview In "Make Your Point," speaker Joe Nay draws on eight years of experience across red team and blue team roles—specifically penetration testing and solutions architecture at Horizon 3 AI—to examine why technical practitioners struggle to motivate change. Recounting an early penetration test where achieving domain administrator privileges failed to spur any remediation from the client, Nay argues that hacking ability is useless if findings cannot be communicated effectively. Because it is no one's explicit job to pay attention, cybersecurity professionals must treat storytelling as a structured discipline to captivate audiences and inspire action.

### Key Topics Nay defines storytelling as the intersection where "facts meet context," serving as an evolutionary human information-exchange mechanism, memory booster, and simulation engine. He breaks down why narrative outperforms laundry lists of technical vulnerabilities and introduces several core narrative principles: - **The "Tell Them" Theory:** Structuring communication by telling the audience what you are going to tell them, telling them what was promised, and recapping what you told them. - **Synopsis vs. Plot Summary:** Distinguishing between an exhaustive, step-by-step account (a plot summary) and a concise, engaging hook that leaves the audience wanting more (a synopsis). - **Audience Expectations and Pacing:** Tailoring technical depth to the audience (such as an executive versus a systems administrator) and dynamically varying delivery speed, including the strategic use of deliberate silence. - **Protagonists and Concrete Impact:** Introducing relatable characters (e.g., an employee clicking a phishing lure) rather than dry reports, and anchoring technical misconfigurations to tangible organizational consequences.

### Technical Details To illustrate the difference between sterile reporting and impactful storytelling, Nay contrasts two ways of presenting identical technical findings from a network penetration test: - **Raw Finding Presentation:** Simply stating discovered flaws, including default-enabled legacy name resolution protocols, SMB signing disabled or not required, and ESC1 Active Directory Certificate Services (ADCS) misconfigurations leading to domain compromise. - **Narrative and Contextual Presentation:** Framing those exact same default configurations and ESC1 misconfigurations in terms of business impact. Rather than merely stating domain compromise occurred, the narrative connects the flaw to operational downtime, potential multi-million dollar losses, brand reputation damage, and ransomware exposure. It concludes with a direct business question: whether management accepts the residual risk or will adjust priorities to remediate it.

### Takeaways Nay emphasizes that technical professionals possess deep expertise and curiosity, but must recognize that the responsibility to captivate attention rests with the presenter. By adopting storytelling fundamentals—introducing a clear synopsis, placing a protagonist into scenarios, pacing presentations with intent, and translating technical flaws into concrete business risks—practitioners can transform routine vulnerability debriefs into compelling narratives that drive real organizational action.