Making the Non-Technical Feel Technical – A Recipe for Success
Whether you are already a cybersecurity leader or aspiring to be one someday, you need to be an effective salesperson and communicator if not already (especially at the board and executive level) to be successful in your role. You need to be able to connect with your audience no matter whether they are very technical or not, or somewhere in between. You need to be able to speak with the audience using language and terms they understand.
While we may use a variety of security vendors, tools, and technical acronyms daily as cyber leaders to communicate with our teams and others in technical roles, most people, including company executives and boards do not. For many of them, it might seem like you are speaking a foreign language where they are only catching part of what you are saying, but getting somewhat distracted or lost when they hear the different terms or technologies mentioned that they have never heard of. You need to be conscientious of this and understand the audience with whom you are communicating.
When selling and advocating for cybersecurity in meetings, you need to shift your communication style to align to the least technical people in the room. While there may be executives or board members that have a more technical background, there are usually others that do not, and those others may be much of your audience. Those with more technical background may want to hear more technical details and want to dive deeper on what you are sharing, but do not fall for that trap.
Instead, recognize the importance of what the more technical people are asking or wanting to discuss and suggest deferring to separate a meeting or discussion where you can go into more details with just them. If you discuss those topics during a meeting with those that are not interested in all those technical details or those that don’t really understand the technical details, those individuals will likely not view your meeting as having gone well. It’s better to recognize and avoid going on about technical details with an audience that in large part is not interested.
A mentor of mine once told me in reference to plumbing that some people want to know how the tap water in their house that comes out of their faucets gets sourced, filtered, cleaned, and transported through their pipes to the various faucets in their house. While others just want to know when they turn on the faucets in their house that the hot and cold water comes out as expected. It is the same with audiences. Some people want the plumbing details to understand how everything works and others do not.
Contrary to what certain others may think or have heard, your biggest asset is not being the smartest or most technical cybersecurity person in the room. You obviously need to have good technical skills, experience, and be capable and knowledgeable in your role or you likely wouldn’t be in the role. Those are great attributes that are important, but if you speak above others’ understanding of cybersecurity and technology or go into too many details on technical items, you may end up intimidating or scaring others into going along with what you are selling because they may not fully understand what’s being presented and are afraid not to go along with it.
I’ve found the use of easily relatable and understandable analogies and stories can be very effective tools to leverage in meetings with various technical skill levels. If you can get your message across in a way that’s engaging and easy to digest, you will likely do a much better job connecting and interacting with your meeting participants. They will be more likely to ask questions or share feedback.
At the end of the day, if those you are trying to educate or sell your proposals or ideas, do not understand or are bored with what you are discussing or why they should care, then they will typically be less interested and less supportive. They will generally see you as having less business acumen and more of just the techie person who doesn’t really understand the business.
However, if you’ve made a meaningful connection on the topics and have given the audience information in a way they can make informed business decisions and provide credible challenges to what you presented where needed, then you will likely be more successful in garnering the support and results you desire. The executives and board members will also likely see you more as someone with strong business acumen, who understands the business and what’s important, and aligns their proposals and recommendations to those items. This will ultimately make it easier for these leaders to see why they should support or approve what you are presenting to them.
I want to share an example that has worked for me to demonstrate how to do this. When building and implementing cybersecurity protections, we come across hundreds if not thousands of vendors, tools, processes, and services that we may consider creating a defense-in-depth, layers security approach. However, I’ve found if we can bucketize these items into easier to understand categories, that executives and board members tend to understand these items better and why they are important.
I will talk to my audience about protecting their home and when protecting their home that they want to do three main things. First, they want to do what they can to keep the bad guys from getting into their home. In other words, protect the front door. Second, if the bad guys do get into their home, they want to make sure the bad guys don’t get away with anything significant. They want to limit the damage and impacts. Third, if the bad guys get in their home, they want to make sure they can detect those bad guys right away and kick them out of their home. I know this creates a very simple view, but it’s highly effective when discussing with less technical audiences. Everyone can relate to these three situations.
At this point, once they understand these three concepts, I can better share my proposals and plug in what I’m asking for into one or more of these categories. For example, I could let them know that what I am proposing is for an additional security layer at the front door of their home that helps me better keep the bad guys out. I’m requesting an additional bouncer. If the first bouncer we have doesn’t keep all the bad guys out, we have a second bouncer that will help catch those bad guys who got past the first bouncer.
Alternatively, I may be proposing a new internal data protection process to reduce negative impacts if a bad guy gets in their home. So, if we better protect our crown jewels in our house, it’s less likely a bad guy will escape with them.
Or I may be proposing a new security monitoring tool that allows our firm to better detect bad guys getting in the house and get them out quickly. Creating these easy-to-understand, less technical analogies and scenarios allows me to better navigate what would otherwise be very technical somewhat challenging discussions.
Unfortunately, in today’s world, while companies can put in multiple layers of front door protections to keep bad guys out, we must assume the bad guys will still find a way to get in. So, we need to plan for the bad guys getting in, and we need to limit or eliminate where possible the damage they cause us, and we need to know right away they got in and have the means to quickly get them out.
Effectively communicating with non-technical leaders and selling your cybersecurity strategies, ideas, and key items needed is critical to achieving and maintaining success as a cybersecurity leader. Being able to help the non-technical leaders that you communicate with regularly feel more technical and able to have an intelligent discussion with you on cybersecurity is a skill that is often overlooked, but that skill should be developed and practiced. It is essential to secure ongoing buy-in, budget dollars, and continued support, which are essential to your short and long-term success.
About the Author
Scott Hennon is a 3-time CISO and former CIO in the financial services industry.
Scott has an extensive background in various areas of IT including Digital Transformation, Engineering, Development, Network Infrastructure, Cybersecurity, Privacy, Regulatory Compliance, Audit, Risk Management, Cloud Migration, Mergers & Acquisitions, and Artificial Intelligence. Scott works well with all levels across the organization. Scott is known for taking complex technical items and make them easier to understand. Scott has an entrepreneurial spirit and is able to build high-performing teams and drive implementation of secure, efficient, and effective processes, and technologies.
Scott can be reached online at [email protected] or https://www.linkedin.com/in/scotthennon/.
