How to communicate with non-security specialists to drive action

The speaker, a product marketing manager with years in security marketing, starts with a pattern she saw while working at a mobile app security firm. Pentesters reported findings, clients delayed fixes, and retests turned up many of the same problems. She notes that the people who find issues often do not own the systems, and that awareness training and champion programs have not fully solved the problem, since human factors still feature in most breaches.

The core of the talk is three ingredients for driving action: provide value, be clear, and connect with the audience. For value, she lists seven reasons people pay attention, including novelty, counter-narratives, controversy, fear, and simple ranked lists that executives can scan. For clarity, she shows how to find jargon in a dense NIST definition of multi-factor authentication using a jargon-highlighting tool and a readability grader, then rewrites it in plainer language that drops to roughly a seventh-grade reading level. For connection, she recommends two books on influence and negotiation and urges practitioners to uncover the real obstacle behind someone's refusal to act.

She closes with a 2017 anecdote in which a session speaker tailored a message to marketers, which prompted her to enable MFA and recheck permissions. In the Q&A she covers following up without sounding punitive, building rapport with remote international partners through informal get-togethers, and learning a new audience by observing people rather than relying on surveys. The takeaway is to tailor messages to each group and explain what a security measure means in their own context.