Words Be Hard: How Security Can Speak Business Lingo

Sean Poris opens with the gap that often separates security teams from the business: when security is seen as the "Department of No," stakeholders stop listening. He recommends a more collaborative stance, starting proposals by asking what the team is trying to achieve before raising risks.

The middle of the session covers business context. Sean suggests learning a company's culture through all-hands meetings, tracking the KPIs stakeholders are measured on, and timing requests around budget cycles, peak seasons and strategic planning, so remediation lands in quieter periods. He then covers empathy, active listening, and positional versus personal influence. A worked example compares the cost of a likely breach with a business opportunity to make a prioritisation case. A second example rewrites an SSRF finding for a product manager using a plain-language analogy, with generative AI suggested as a drafting aid for that kind of translation.

The closing portion focuses on relationships: joining launch celebrations and sprint planning, working through security champions embedded in development teams, and keeping rapport going when teams are remote. The takeaway is that clear, business-framed communication and sustained trust let security shape decisions rather than block them.