5-Step Method for Turning Security Findings Into Stories

Victoria Mosby opens with a common frustration: security teams write accurate reports that leaders acknowledge but rarely act on. She uses a fictional financial firm, Meridian Finance, and follows a CISO who must ask a chief financial officer for budget to remove standing administrator credentials left in two legacy directory forests. The request is politically sensitive because a similar fix was deferred in an earlier assessment, and peer firms have since been breached through the same weakness.

The core of the session is a five-step method. The presenter first reduces the request to one sentence that names the decision, the amount, the deadline and the stakes. Next she picks a narrative pattern from a framework she calls the saga model. She contrasts a "prophet's warning," which recounts an ignored finding and assigns accountability, with a "dragon's awakening," which presents the same facts as a current risk without blame. The remaining steps cover mapping the realm, the decision-makers and the proposed work, choosing how much story to add on a conservative-to-full-narrative scale, and checking that every metaphor still rests on verifiable data. She walks through a second example about replacing an end-of-service portfolio platform.

The takeaway is practical. Mosby asks attendees to apply the method to one finding before their next working day, present both the original and reframed versions to a stakeholder, and see which one gets a response. She stresses keeping numbers constant and avoiding jargon and theatrics.