Cyber Risk is Business Risk

I've been carrying this book around for at least fifteen years. Piles of notes, a thesis, a clear sense of what I wanted to say, and a life that kept getting in the way. What kept pulling me back was something I'd watched happen in room after room: smart people trying to explain an idea across a conference table, and failing. The words were accurate. The reasoning was sound. But the message never landed, because the person on the other side didn't speak the same language.

I've always been able to take something complicated and make it simple. In security, that turned out to be the whole game. I've sat through too many meetings where good people couldn't get through to the executives they were asking to fund the work, and watched the company pay for it later. This book is my answer to that.

So I didn't write it for technical people or security people. I wrote it for the C-suite and the boardroom, for the executive who has to make the call. The readers who've seen early chapters all say the same thing: it makes sense. They can cut through the noise and the jargon, ask the right questions, and get meaningful answers. I owe a lot of that to a bank president you'll meet in the introduction, who taught me what it really means to communicate with the person across the table. And I owe the nudge to a friend and mentor who told me, almost a year ago, that it was time to finally write it. He was right.

If you take one thing from these pages, I hope it's this: don't nod politely and move on to the next item on the agenda. Pause. Ask the right question. Demand the answer you actually need. If you're the person whose signature ends up on the risk, this book is for you, and I hope you buy a copy for everyone on your leadership team. Not because I want to sell books, but because clear conversations about the things that matter are worth it.

— Chris