I was at BSides Luxembourg recently and attended a workshop called Zero to Trusted Adviser: Selling Security to the Business. Four hours. And honestly more useful than most certification prep I have done — not because it covered threats or frameworks, but because it tackled the one thing nobody actually trains you for in this industry.
How do you get people to act?
You can know everything. You can have the certs, the data, the risk assessments, the audit findings. You can walk into a boardroom knowing exactly what needs to happen and walk out with nothing — no budget, no decision, no urgency. Not because you were wrong. Because you spoke the wrong language to the wrong people in the wrong way. That is what this workshop fixed.
Know Who Is Actually Sitting Across From You
Before you pitch anything, you need to know who you are pitching to. Not their job title — what they actually care about, how much influence they hold, and how much they currently care about security.
The five-step process: identify your stakeholders, rate their influence and interest, map them, build specific influence strategies, and identify what personally drives each one. That last step is what most people skip. And it is the only one that actually matters.
The Psychology in the Room Is Working Against You
The people you are trying to convince are not irrational. They are human. And they are operating through biases that will quietly kill every pitch you make.
Speak in dollars and cents. Not CVE scores, not risk matrices, not breach statistics. What does this cost us if it goes wrong? What is the daily cost of being down? Speak in the currency they already think in.
The Art of Making It Their Problem
The pitching framework was three things: problem, solution, benefit. Simple — but the execution is everything.
The problem has to belong to everyone in the room, not just you. The moment it sounds like a security department issue that needs a security department budget, everyone else mentally hands it back to you. A data breach is not a CISO failure. It is a business failure. A regulatory fine does not land on the security team. It lands on the company.
Then come with a solution — a real one, a clear one, with a specific ask. Be the person who walks in with the answer, not just the question. Then make the business value explicit. Tie it to something they already care about — revenue, compliance, operations, customer trust. A well-designed single slide will land harder in a boardroom than forty pages of threat intelligence every time.
When They Push Back — And They Will
The surface objection is almost never the real one. Someone saying we do not have budget right now might actually be saying I do not trust that this will deliver. Respond to the real thing, not the surface thing.
Fear, uncertainty and doubt might create a reaction in the room but it does not create trust. It is essentially threatening people into action and it will work exactly once before they stop inviting you to meetings.