Talk the Talk: Communicating Business Risk During Cyber Incidents

The talk focuses on the gap between an incident response team and the business leaders who need information while an incident is still unfolding. Alex Nette explains that executives, customers, regulators, peers and co-workers tend to want the same thing: a clear picture of what happened and a path to restoring operations while protecting the company's reputation. Answering with a vague status line quickly erodes trust.

The middle section offers practical tactics. Map each affected system to the business process it supports, give a time-to-recovery range rather than a non-answer, and ask for specific help such as money, staff, or a short outage leadership can approve. Keep updates flowing as estimates change, and maintain contact lists that account for remote or absent staff. Nette also notes that news coverage tends to highlight dramatic attacks while routine ones like social engineering go underreported, which can skew leadership's view of risk.

The closing portion covers preparation and follow-up. Contingency planning should include things like spare laptops and alternate work sites, and disaster recovery should be tested by actually failing over rather than only discussed in a tabletop exercise. After an event, document a lessons-learned report that ties the incident to business impact. Finally, frame security investments in quantitative terms, estimating loss magnitude and frequency so finance leaders can weigh control costs against expected losses.