How to Win Over Executives and Hack the Board

Alyssa Miller, a long-serving security leader who has reported to several boards, opens by naming common habits that weaken security briefings to executives. These include treating a breach as an opening to ask for money, describing security mainly as risk management, leading with metrics such as vulnerability counts and dashboards that lack context, and walking boards through lists of technology purchases they cannot relate to.

The middle of the talk reframes the problem by borrowing a penetration tester's approach. Before a meeting, research each board member's background, such as their industry and regulatory exposure, and plan the message around what they actually want to know: whether the organisation is secure, whether spending is well placed, and what should worry them. Explain the reasoning behind each project, connect it to business outcomes such as faster development, freed-up help desk time or new markets, and present a short roadmap of a few initiatives instead of a long list. Even after an incident, highlight the controls that worked.

For practitioners, the takeaways are to keep the core briefing to about three slides with detail moved to an appendix, state the top risks and the plan for addressing them, expect interruptions and unexpected questions, and keep the message simple enough that the board wants the next update.