W7_ISSC662_Example

Example:

Beyond Vulnerabilities: Fixing the Communication Gap

Select the Start button to begin

Start

Select the Listen button to play the narration for this slide

Navigation

Listen

buttons

Use the following buttons to navigate through the course content

Listen

Play the audio for the current page

hOME

nEXT

PREVIOUS

Return to the previous page

Return to the course home page

Move to the next page

home

next

previous

Select the Listen button to play the narration for this slide

Listen

Hi, I’m Michael, and I want to tell you about a time when our biggest security problem wasn’t a vulnerability—it was a communication gap that kept us fragile.

home

next

previous

Select the Listen button to play the narration for this slide.

Listen

Part I - The Situation

You’re part of a security team that has done real work. You’ve built controls, improved processes, and started measuring effectiveness. From your perspective, the program is getting stronger. But then you notice something: leadership still treats security as a surprise. Every time a new risk appears, the reaction is emotional—panic, denial, or “just make it go away.” And every time the security team asks for resources, the answer is delayed, debated, or dismissed.

home

next

previous

Listen

Select the Listen button to play the narration for this slide.

The Situation

That’s what was happening in my organization, a national retail company with both online services and physical locations. We were modernizing quickly, which meant risk was changing quickly too. We had legacy systems in stores, modern cloud services, and third-party vendors connecting everything together.

From a technical standpoint, the security story was clear: our biggest risk wasn’t a single vulnerability. It was inconsistency. Different locations handled security differently. Vendor onboarding standards were uneven. Logging coverage was incomplete. Some teams had strong response routines; others relied on one or two people who “just knew what to do.”

home

next

previous

Listen

Select the Listen button to play the narration for this slide.

The Situation

But when we tried to explain this to leadership, it didn’t land. We used terms like “attack surface,” “lateral movement,” “privilege escalation,” and “control drift.” Leadership nodded politely, then asked questions that showed they didn’t actually understand what was at stake:

• “Is this theoretical?”
• “Can we just patch it?”
• “Are we compliant?”
• “Are customers impacted right now?”

We were speaking truth, but in the wrong language.

home

next

previous

Select the Listen button to play the narration for this slide.

Listen

Part II - The Shift

We changed our approach by deciding to build a risk communication structure, not just a presentation. First, we stopped leading with technical detail and started leading with outcomes:

• What could go wrong?
• How bad would it be?
• How likely is it in our environment?
• What would reduce the risk meaningfully?
• What decision do we need from leadership?

home

next

previous

Select the Listen button to play the narration for this slide.

Listen

Investigation

Then we built a “risk narrative template.” Every major risk briefing had four parts:

• The story in plain language (two minutes).
• The exposure and impact (what it could cost, disrupt, or harm).
• The maturity angle (why this risk exists: capability gaps, process inconsistency, control drift).
• The ask (what decision, funding, or prioritization was required).

home

next

previous

Listen

Select the Listen button to play the narration for this slide.

Response

We also changed how we used metrics. Instead of flooding leadership with numbers, we used three indicators tied to resilience:

• Detection-to-response time (how quickly we move from “we see it” to “we act”).
• Exception volume and aging (where drift is growing quietly).
• Coverage gaps (where we can’t see or control critical assets consistently).

And we practiced. We literally practiced risk briefings with non-technical stakeholders and asked, “What did you hear? What was unclear? What do you need to decide?” That practice was humbling, but it worked.

home

next

previous

Listen

Select the Listen button to play the narration for this slide.

Part III - Results

Within a few cycles, leadership’s behavior changed. Instead of asking, “Is this theoretical?” they asked, “What decision do you need from us?” Instead of asking, “Can we just patch it?” they asked, “Is this a one-time fix or a capability gap?” Instead of asking, “Are we compliant?” they asked, “How resilient are we if this happens during peak season?”

That shift improved resilience immediately. Not because threats disappeared, but because decisions happened faster and with clearer support.

home

next

previous

Select the Listen button to play the narration for this slide.

Listen

Results

Teams also changed. When managers understood the “why,” they stopped seeing controls as bureaucracy and started seeing them as protection for operations. Adoption improved, not through fear, but through shared understanding.

home

next

previous

Listen

Select the Listen button to play the narration for this slide.

Part IV - Takeaway

Here’s your takeaway for Week 7: resilience is not just technical strength. It’s coordination under pressure. And coordination depends on communication. If people don’t share the same understanding of risk, they can’t act together. You end up with delays, confusion, and reactive decisions. When you communicate risk clearly—matching the audience, focusing on outcomes, and making the decision path obvious—you don’t just inform people. You build resilience.

home

next

previous

Select the Listen button to play the narration for this slide

Listen

Congratulations!

You've successfully completed the example

home

previous