PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Tips to building better board decks for CISOs

bugcrowd.com | blog | #risk-management | #ciso | #board-communication | #security-budget | #presentation
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Boards approve growth spend but freeze on security budgets because they lack context. CISOs should answer three board questions—what to know, why it matters, what to decide—to calibrate risk tolerance.
Published
Collected

Related coverage

blog · netspi.com
Counseling the Corporate Board
A NetSPI post cites the Ponemon quip that 88% of firms spend more on coffee than app security, using Night Dragon and fighter-jet thefts to urge boards to fund security and demand posture reporting.
blog · bugcrowd.com
The CISO’s challenge: Measuring security outcomes
Adversarial testing evaluates defenses by applying the tactics, techniques, and procedures of real-world attackers, highlighting program deficiencies that rise above agreed-upon risk profiles.
blog · bugcrowd.com
Risk committees for CISOs: Moving from technical expertise to executive strategy
When boards see CISOs as jargon-speaking technicians, budget asks stall. Risk committees evaluate security through a business lens, turning isolated assessments into validated strategic imperatives.
blog · bugcrowd.com
A CISO’s guide to red teaming part 2: Using red team outcomes for executive decision making
A red team's value lies in what organizations do with results: actionable insights—like evidence a stolen CEO credential exposed M&A data—that drive budgets, SOC fixes, and board decisions.
blog · bugcrowd.com
This is No Time to Retreat In Cybersecurity
Bugcrowd CIO Nick McKenzie argues cybersecurity budgets should be exempt from cost cuts: breach costs average $4.35M, and stock prices underperform for years after incidents.
blog · hackerone.com
Making the Business Case for AI Security: How to Show Value with Return on Mitigation
HackerOne's new whitepaper promotes Return on Mitigation (RoM) to quantify avoided losses versus mitigation cost, helping security leaders justify AI security budgets, based on a 550-leader survey.
Back