­
Effectively Communicating Risk to Management By Bikash Barai and Allan Alford - All Articles - CISO Platform
Effectively Communicating Risk to Management By Bikash Barai and Allan Alford

Effective risk communication to management or board members is essential for informed decision-making. This clip explores various models and approaches for communicating risk, ranging from traditional methods to more visually-oriented techniques.

 

 

Here is the verbatim discussion:

How would you uh communicate that risk to the management or board members right so the traditional model of the 5x5 matrix likelihood and impact and you know high medium low etc it's the most popular model it's a model that many boards respond to well and and it's a model that will resonate with those boards there are plenty of detractors in our industry who will point out that that likelihood impact is is a messed up mess um some people will talk about how the scales are ordinal and yet some people use it as a multiplicative in other words  five and five is twenty-five not ten uh you multiply the numbers instead of adding them which with an ordinal scale makes no sense but helps to demonstrate the drama of this is really bad this is really good yo know 1 to 25 is a much more pronounced scale some people do that and the boards respond to it quite well some stick with the standard ordinal and math and that seems to work well some people don't even put the numbers and simply do a heat map i had one company i worked for where reporting upstairs um was literally just the red yellow green hea map but in a very nice gradient manner without the numbers words there but not numbers there of likelihood and impact and um arrows with the dot and the line and the triangle at the end to show we started here and we got to there and you can show where we reduced likelihood dramatically but impact stayed the same or we managed to partially reduce likelihood and impact both or whatever.
 
 
 

Highlights :

Traditional 5x5 Matrix: Likelihood and Impact

  • Widely used model for risk communication.
  • Some critics highlight issues with ordinal scales and multiplication.
  • Boards often respond well to this model due to its familiarity.

Alternative Approaches:

  • Some use multiplication of likelihood and impact for dramatic effect.
  • Others opt for a simple red, yellow, green heat map without numerical values.
  • Visual aids like arrows and symbols can enhance understanding of risk trends and mitigation efforts.

 

Risk communication requires tailoring to the audience's preferences and understanding. Whether utilizing traditional 5x5 matrices or visual heat maps, the goal is to convey risk effectively to facilitate informed decision-making by management or board members.

 
 
Speakers:
 

Bikash Barai is credited for several innovations in the domain of Network Security and Anti-Spam Technologies and has multiple patents in USPTO. Fortune recognized Bikash among India’s Top 40 Business Leaders under the age of 40 (Fortune 40-under-40).Bikash is also an active speaker and has spoken at various forums like TiE, RSA Conference USA, TEDx etc.

Earlier he founded iViZ an IDG Ventures-backed company that was later acquired by Cigital and now Synopsys. iViZ was the first company in the world to take Ethical Hacking (or Penetration Testing) to the cloud.

 

https://twitter.com/bikashbarai1

https://www.linkedin.com/in/bikashbarai/ 

 

Allan Alford was in the CISO/CTO at TrustMAPP, a cybersecurity performance management company. With 20+ years in information security, he has served as CISO four other times in three industries. Alford parlayed an IT career into a product security career and then ultimately fused the two disciplines.

He has led security efforts in companies from five employees to 50,000 and executes a risk-based approach to security, as well as compliance with many, many frameworks. Alford gives back to the security community via The Cyber Ranch Podcast and by authoring articles and speaking at conferences. Alford holds a Master of Information Systems & Security, a Bachelor of Liberal Arts (with a focus on leadership) and a now-expired CISM certification.

 

 https://twitter.com/AllanAlfordinTX

https://www.linkedin.com/in/allanalford/

 

 

Votes: 0
E-mail me when people leave their comments –

You need to be a member of CISO Platform to add comments!

Join CISO Platform

Join The Community Discussion

CISO Platform

A global community of 5K+ Senior IT Security executives and 40K+ subscribers with the vision of meaningful collaboration, knowledge, and intelligence sharing to fight the growing cyber security threats.

Join CISO Community Share Your Knowledge (Post A Blog)
 

 

 

CISO Platform Talks : Security FireSide Chat With A Top CISO or equivalent (bi-monthly)

  • Description:

    CISO Platform Talks: Security Fireside Chat With a Top CISO

    Join us for the CISOPlatform Fireside Chat, a power-packed 30-minute virtual conversation where we bring together some of the brightest minds in cybersecurity to share strategic insights, real-world experiences, and emerging trends. This exclusive monthly session is designed for senior cybersecurity leaders looking to stay ahead in an ever-evolving landscape.

    We’ve had the privilege of…

  • Created by: Biswajit Banerjee
  • Tags: ciso, fireside chat

CISO MeetUp: Executive Cocktail Reception @ Black Hat USA , Las Vegas 2025

  • Description:

    We are excited to invite you to the CISO MeetUp: Executive Cocktail Reception if you are there at the Black Hat Conference USA, Las Vegas 2025. This event is organized by EC-Council & FireCompass with CISOPlatform as proud community partner. 

    This evening is designed for Director-level and above cybersecurity professionals to connect, collaborate, and unwind in a relaxed setting. Enjoy…

  • Created by: Biswajit Banerjee
  • Tags: black hat 2025, ciso meetup, cocktail reception, usa events, cybersecurity events

6 City Playbook Round Table Series (Delhi, Mumbai, Bangalore, Pune, Chennai, Kolkata)

  • Description:

    Join us for an exclusive 6-city roundtable series across Delhi, Mumbai, Bangalore, Pune, Chennai, and Kolkata. Curated for top cybersecurity leaders, this series will spotlight proven strategies, real-world insights, and impactful playbooks from the industry’s best.

    Network with peers, exchange ideas, and contribute to shaping the Top 100 Security Playbooks of the year.

    Date : Sept 2025 - Oct 2025

    Venue: Delhi, Mumbai, Bangalore, Pune,…

  • Created by: Biswajit Banerjee

CISO MeetUp @National Insider Risk Symposium, Washington DC, USA 2025

  • Description:

    We are excited to invite you to the 10th National Insider Risk Symposium, a premier forum bringing together leaders and experts from both the commercial and public sectors to address the evolving landscape of insider threats. CISOPlatform is a proud community partner for this event. 

    Event Details:
    Venue: National Housing Center, 1201 15th St NW, Washington, D.C. 20005
    Dates: September 17–18,…

  • Created by: Biswajit Banerjee
  • Tags: national insider risk symposium, ciso, cybersecurity events, usa events