{"id":16390,"date":"2026-06-22T07:06:14","date_gmt":"2026-06-22T07:06:14","guid":{"rendered":"https:\/\/newestek.com\/?p=16390"},"modified":"2026-06-22T07:06:14","modified_gmt":"2026-06-22T07:06:14","slug":"6-security-leader-tips-for-mastering-business-risk","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=16390","title":{"rendered":"6 security leader tips for mastering business risk"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
<\/div>\n<\/section>\n

Longtime security leader Doug Kersten<\/a> has expanded his list of responsibilities.<\/p>\n

As CISO of software maker Appfire, he now has accountability for business risks, such as how security tools and processes within customer products and services impact their costs and, thus, profitability.<\/p>\n

It\u2019s a clearcut example, he says, of where and why CISOs must consider not purely security risk, but also business risk.<\/p>\n

\u201cCISOs need to provide input and remediation on the impact of security cost because these often-hidden costs have a negative impact on profitability,\u201d he says. \u201cThis is usually overlooked by finance teams when analyzing the true cost of goods sold, and if CISOs are not plugged into the evaluation of business risk, it can easily be dismissed.\u201d<\/p>\n

The expansion of Kersten\u2019s remit into business risk isn\u2019t unique. CISOs across industries are increasingly expected to identify and address business risks that in the past had been outside the bounds of their roles.<\/p>\n

\u201cWhile CISOs traditionally focused on protecting systems, networks, and data, today\u2019s business environment requires security leaders to understand how cyber threats impact revenue, operations, customer trust, regulatory obligations, supply chains, and strategic objectives,\u201d says Dale Hoak<\/a>, CISO at software firm RegScale. \u201cThe distinction between business risk and security risk is becoming increasingly blurred.\u201d<\/p>\n

As such, CISOs today must be enterprise risk leaders<\/a>, he says, capable of advising executives on how security decisions affect the organization\u2019s ability to achieve its business objectives \u2014 not just how they impact the IT stack or technology performance.<\/p>\n

Understanding business risk is a significant task, experts agree, but they stress that security chiefs are capable of mastering the skill. Here, Kersten, Hoak, and other security leaders offer strategies on how to do so.<\/p>\n

1. Partner with the owners of business risk<\/h2>\n

By his own admission, Roland Palmer<\/a>, CISO and vice president of tech company JumpCloud, has yet to master business risk. So he\u2019s partnering with those in his organization who own it, so he has opportunities to learn and contribute.<\/p>\n

\u201cWe form a great team to understand risk and the organization\u2019s risk appetite,\u201d he says.<\/p>\n

Team members include leaders from legal, finance, and marketing, as well as the COO.<\/p>\n

Kersten similarly leans on business leaders to sharpen his understanding of business risk. Last year Kersten, working with his exec colleagues, devised a program assigning business leaders to security risks.<\/p>\n

\u201cSecurity helps them understand the security risks, but they also bring to us the [associated] business risks and what can be done to mitigate them,\u201d he explains, noting that this approach also surfaced risks that have since been addressed, thereby closing gaps<\/a> that were previously unknown.<\/p>\n

2. Align cybersecurity explicitly to business objectives<\/h2>\n

Kerstan believes security teams must understand business objectives<\/a>, so they can understand what risks could derail which objectives. To ensure his security program has that knowledge, he incorporates corporate objectives and key results into his security strategy.<\/p>\n

\u201cI build out plans to address those business objectives and key results. I still have that parallel tier of security risk, which is handled by the security team; that doesn\u2019t go away. But layered onto this is the business OKRs<\/a> that I need to execute against,\u201d he explains. \u201cIt changed how we look at risk and what we have to do.\u201d<\/p>\n

For example, he now considers how security department actions may impact employee satisfaction and how that relates to employ retention, a business risk identified by HR, \u201cso we\u2019re working to make sure what we do aligns to the needs of the HR department.\u201d<\/p>\n

Richard Watson<\/a>, global cybersecurity leader with professional services firm EY, agrees with the need to \u201calign cybersecurity explicitly to business objectives.\u201d<\/p>\n

\u201cMap cyber controls to critical assets and business processes, and link these to potential financial impact,\u201d he advises. \u201cThis enables CISOs to translate technical exposure into business terms and prioritize investment accordingly.\u201d<\/p>\n

3. Lean into networking and relationships<\/h2>\n

Another effective way to get a good grasp on business risks: talking with business colleagues. Regular conversations often yield insights into what truly has them worried, says Gary Hayslip<\/a>, a cybersecurity executive and co-author of the CISO Desk Reference Guide<\/em>.<\/p>\n

\u201cAnother thing I have done to understand business risks, and I have recommended it to peers, is doing a walk-about or what some people call a listening tour,\u201d he says. \u201cI do this in every role I am in because I feel it\u2019s important to understand their objectives, the technologies they use, the projects they have ongoing, the issues they may have with the security program, and, finally, what genuinely keeps them up at night.\u201d<\/p>\n

Others say they take a similar approach, stressing the value of networking and building relationships where colleagues feel comfortable raising concerns and collaborating on solutions.<\/p>\n

\u201cBusiness risk cannot be managed in isolation. CISOs should regularly engage with the CFO, COO, general counsel, chief risk officer, product leaders, and business unit executives,\u201d Hoak says. \u201cThese conversations provide insight into emerging business concerns and help security become part of strategic planning rather than a downstream compliance exercise.\u201d<\/p>\n

4. Run tabletop exercises focused on business risk<\/h2>\n

This is a more structured opportunity, but an equally effective one, to gain more insights into business risks \u2014 so long as the exercises put the business front and center, Hayslip says.<\/p>\n

\u201cMost tabletop exercises<\/a> conducted by the CISO and security teams remain technical and stop at containment. I have found it\u2019s better to run scenarios that force the executives into the decisions they\u2019d actually make during a crisis, such as whether to pay a ransom<\/a>, when and what to disclose if there is a data breach, how to handle customers, when and who should invoke legal privilege, and is there an operational fallback available and if so who makes the decision to activate it,\u201d Hayslip says.<\/p>\n

\u201cRunning these types of scenarios helps stress-test the company\u2019s response and teaches the CISO and security team how their peers make decisions under pressure,\u201d he adds.<\/p>\n

5. Study up on business risk<\/h2>\n

Sean Murphy<\/a>, senior vice president and CISO at BECU, the fifth-largest credit union in the US, didn\u2019t leave learning about business risk to serendipity. He sought out opportunities for formal learning, such as earning the Directorship Certification from the National Association of Corporate Directors<\/a>. The certification verifies the holder\u2019s expertise in governance, fiduciary duties, strategy, and risk oversight.<\/p>\n

Murphy sought the certification to strengthen his qualifications for a board position<\/a> and to better understand the perspectives of his company\u2019s board, including how it views risk. \u201cThe certification helps me delve into what the board cares about and their world and helps me then turn that back to my team and what we\u2019re doing,\u201d he adds. \u201cIt gives me the business and executive view versus a purely technical and security view.\u201d<\/p>\n

Others offer similar learning strategies.<\/p>\n

\u201cThe CISO needs to see the company the way the CEO, CFO, and board do,\u201d Hayslip says. \u201cTo begin, I would recommend sitting down with the 10-K or annual report, the investor deck, and the earnings call transcripts. This will help the CISO understand how the company makes money and which products or business units drive revenue. It also helps the CISO understand what the leadership team is publicly telling the Street about key risks and where they believe revenue growth will come from in the next reporting cycle.\u201d<\/p>\n

This work, while perhaps previously not essential for traditional security leaders, is becoming an imperative today.<\/p>\n

\u201cThis isn\u2019t fun; in fact, it can be boring,\u201d Murphy says. \u201cBut the CISO can\u2019t prioritize protecting the business if they don\u2019t know which parts of the business are considered critical. The annual report provides that view in the words of management.\u201d<\/p>\n

Veteran security leaders also cite the value of earning certifications from ISACA<\/a>, a professional association for governance and risk professionals, as well as the Institute of Internal Auditors\u2019 Certified Internal Auditor designation<\/a>.<\/p>\n

6. Integrate security into enterprise risk management<\/h2>\n

To truly master business risk, CISOs should not treat it as separate from security risk.<\/p>\n

\u201cCyber is now an existential business risk, not just an IT risk,\u201d says Scott Melchior<\/a>, a member of ISACA\u2019s Emerging Trends Working Group with 20 years of experience at a global consulting firm focusing on governance, risk, and compliance. \u201cDigital infrastructure is business infrastructure. They\u2019re too intertwined to separate.\u201d<\/p>\n

Hoak agrees, stressing the need for CISOs to integrate security into enterprise risk management<\/a>.<\/p>\n

\u201cCyber risk should be incorporated into broader enterprise risk management processes alongside financial, operational, legal, and strategic risks. This creates a common framework for evaluating risk and helps executive leadership view cybersecurity within the context of overall business objectives,\u201d he says.<\/p>\n

Hayslip has put this into practice. In his CISO roles, he has plugged the security risk register into the organization\u2019s ERM platform. He says this allowed him to present cyber-related risks on the same platform that the board already reviews alongside financial, operational, and strategic risks.<\/p>\n

\u201cThe goal is for cyber risks to appear on the enterprise heat map as every other material risk, so they compete for resources and attention on equal terms rather than being a sidebar,\u201d Hayslip says. \u201cNow there is some work involved for the CISO to do this correctly, but it\u2019s critically important to quantify cyber risk in dollars and probability, not colors. Moving from qualitative heat maps to financial impact numbers, I have found, is one of the biggest improvements in getting the business to hear the CISO.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Longtime security leader Doug Kersten has expanded his list of responsibilities. As CISO of software maker Appfire, he now has accountability for business risks, such as how security tools and processes within customer products and services impact their costs and, thus, profitability. It\u2019s a clearcut example, he says, of where and why CISOs must consider not purely security risk, but also business risk. \u201cCISOs need… <\/p>\n

Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-16390","post","type-post","status-publish","format-standard","hentry","category-uncategorized","is-cat-link-borders-light is-cat-link-rounded"],"_links":{"self":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16390","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=16390"}],"version-history":[{"count":0,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16390\/revisions"}],"wp:attachment":[{"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16390"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16390"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16390"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}