How to avoid being labeled a “Chicken Little” while promoting better security decision making

Vanessa Redman opens with the difficulty security teams face in getting business leaders and IT colleagues to adopt better hygiene practices. She presents the talk as a conversation about soft skills rarely covered in formal training, aimed at people moving into middle management who now influence decisions rather than only carry them out.

The core is a set of negotiation techniques borrowed from other industries. Among them: keep tone measured so urgency does not read as alarm, reserve dramatic language for truly serious events, and lower expectations about how fast an environment can change. She suggests proposing a deliberately extreme option so others can rule it out, defining non-negotiables while accepting "not yet" answers placed on a roadmap, and offering a fair, low-cost path with compensating controls. Offering to write documentation is a useful value add, and framing risk in the business's own vocabulary helps. Pitfalls include reports without recommendations, no follow-up, and constant negativity that ignores progress.

Redman closes by noting that even a well-prepared pitch can be rejected, and that the practical response is to keep the initiative alive, log it for later, and attach security work to existing compliance efforts. She frames the advice as opinion drawn from experience and invites the audience to compare their own results.