In this recorded discussion from a cybersecurity meetup, speaker A raises the upcoming SEC proposal that publicly traded companies, including hedge funds and private equity firms, must demonstrate board-level cybersecurity expertise. Matthew Rosenquist agrees that board cyber competence is essential and views regulation as a necessary corrective after industry self‑regulation failed, though he criticizes regulation’s rigidity. The conversation then pivots to the CISO’s role in communicating with boards. Speaker A argues that CISOs should abandon attempts to speak the board’s financial language and instead use fear, urgency, and technical narratives (e.g., the cyber kill chain, EternalBlue) to secure funding, citing the Intel‑McAfee acquisition as an example of poor security‑related investment decisions. Rosenquist counters, emphasizing the need to educate the board, translate risk into business terms, and avoid over‑reliance on fear‑based messaging, which can erode credibility over time. They debate how to define and quantify risk, discuss risk‑transfer mechanisms (insurance, mitigation, acceptance), and reference thought leaders (Anton, Andrew Jockwith, Dan Geer, Wade Baker) and concepts such as black‑swan events. The dialogue ends with a mutual acknowledgment that effective board communication requires a balance of technical insight, risk framing, and alignment with business objectives, while recognizing that even perfect security cannot guarantee the absence of incidents.
Chapters
Hey, Matt. Um, there's been a lot of, uh, anticipation of what the SEC has been, um, putting out there for public comment. And the one that gets everybody's attention is a requirement for publicly traded companies that they cover, which don't forget include, they also cover hedge funds and that includes a lot of private equity companies, but it's going to require them to, to demonstrate that a board member has cybersecurity chops, for lack of a better word. So it brings up a couple of things. One, what do you think is going to happen if they actually rule that? But to back off and like get down to the CISO's job today of talking to the board.
Well, first off, it's about time, right? Having cybersecurity, some level of expertise or understanding or advocacy at the board level It's table stakes nowadays for any company doing business on the internet, having any type of electronic communications, any type of electronic dependencies with supply chain products, customers, any of that, which constitutes most of the companies out there, as well as critical infrastructure that's out there. Okay. So if you lack a board that can even spell cybersecurity, you are going to be an easy victim, right? It's gonna be a bad day for you, your shareholders, and your customers, not to mention your suppliers and partners. So don't be that weak link. This regulation, right? This discussion that's coming up is unfortunately a result of the industry not self-regulating itself, not doing what common sense says they should do. And because the industry hasn't, now the government has to come in. We're seeing the same thing in Australia, right? The government's gonna come in and say, okay, we're gonna mandate just some basic things because guess what, guys and gals, you failed to do the basics. Okay, so first and foremost, yes, if the industries cannot at least show that they have some competencies when it comes to cybersecurity at the board level, Yes, put the regulations in. And I hate regulations, by the way. I absolutely positively think that they are terrible in 99% of the cases. They're not responsive enough. They're too static. You know, the attackers, they get the advantage. There's so many problems. But that 1%, when companies do not do, right, what is best for their customers, partners, and suppliers, when the financial incentives are not aligned aligned, which they should be, but for whatever reason they're not, regulation has to come in. We saw it with privacy, we're gonna see it with cybersecurity. So yes, everybody should stop complaining. Everybody should nod their head. Yeah, okay, we need to have cybersecurity. The question then becomes, how do, does this manifest? And this is where the CISOs becomes a huge opportunity for CISOs, for security advocates within the companies, even within the product groups. To be able to get more face time, to be able to get the message across, to be able to push good strategic plans and tactical maneuvers that will help. But there's also then a lot of responsibility that's gonna be placed on that CISO to be, okay, be the expert. We're gonna expect if you're gonna come to the board, A, you can speak board language, B, you can convince us in business terms, not just fear and risk and uncertainty or doubt or throw up a few ugly articles the news, right? You have to come be able to show value and then execute to that, given the fact that there's a huge degree of ambiguity and chaos in your world. That's where we're going to be. So it's a step forward, but it's not an easy step.
No, it's not. So I recently made the argument that the CISOs have to learn how to sell more FUD and stop trying to speak the business language. And so I just want to lay this out for you.
The— Okay, convince me.
Yeah, I'll try. We've been telling CISOs for two decades now that they have to learn the business language. They're speaking to the CFO and the rest of the board who are pretty cognizant of financial matters. And if you go in, you know, I sit on a couple boards and, you know, it's a steep learning curve for a technologist because all of a sudden they're speaking a different language. And you feel stupid if you don't know what internal rate of return is or all the other metrics that they're talking about all the time. If you turn around and try and educate yourself on that business language, you are handing the reins of the discussion to the real expert in the room who's a CFO and quite often the CEO. But all the great meetings I've had with cybersecurity technologists They blow me away with their knowledge and they can use terms I don't know, but I can easily look them up and I get educated on what they're talking about. And my argument is that you should regain the ground and start educating the board about what's actually happening. In other words, you walk in there and you say, look it, there's something called the cyber kill chain and it involves reconnaissance and weaponization and early access and spreading across the network. And we caught this one thing and it used this, you know, EternalBlue with— and where that came from, the NSA produced this exploit and it was in use for years before somebody stole it from them. And now it was used to take down, you know, most of Europe and cause $4 billion in damage. You got to know about that and you've got to feel the fear because people like to think of boards as deliberative bodies and they make smart decisions, but anybody who's been on a board or participated in board meetings know that at the end of the day, it's all personalities. It's all ego. And you know, the major investments that companies make isn't driven by those spreadsheets that the CFO's presenting. It's driven by the CEO desire to do something. And he or she wants to get into consumer. So they're gonna just go full bore ahead. They'll do all the studies and cover their, their compliance requirements, but they're just going to do it because they want to do it. Or some of the stupid acquisitions. Come on. We know that Intel, when they bought McAfee, did not make a wise choice. There was zero synergy between a desktop antivirus solution and Intel chips, right? And they were already losing the battle to AMD and Nvidia, and they decided this was their savior to spend $6 billion on a completely failed experiment. It took replacing everybody. In the executive organization for them to finally be able to save face and get rid of that dog that was, you know, chained around their neck. So I feel strongly about this. I think I've seen CISOs who present to the boards in that manner and they're extremely successful. You gotta, you know, sell to the emotions, not to the rational spreadsheets, financial talk.
I'm going to wholeheartedly disagree with you here, but I will agree with several points. First off, you do need to educate the board. You do. Second off, the second point I will agree to you or agree with you is that the organization, right, is often led by people's personal desires, right? They're at that level. They have that. But, you know, there's also— they know they will get sustaining support if it's a profitable company and the quarterly report looks good. Right? So yeah, you can have your pet projects, but that quarterly report will really look good. The issue that I have with— oh, and the third issue is if you do go in there, right, look at this exploit, look at this bad thing, right? You're promoting fear. That only lasts for so long because you may get some funding and go off and spend it, but a year later or three-quarters later when you are hacked, They're gonna look at you and go, well, what happened? You said this was the threat. We gave you money and either you lied to us, you were, or you were incompetent or you misspent the money. Either way, it's time for a new CISO. So you will not build your personal credibility. So let's unwind this a little bit and let's start with that communication because CISOs do need to go in, they do need to educate. But if you consider kind of concentric circles, right? Our Venn diagram, let's look at it that way. You've got the knowledge of the board board and how they speak, right? And a lot of it's around the finances because they're driven quarter to quarter typically by profits. Many companies are profit-driven. Okay, great. Now you've got security and you've got, you know, you want to talk about attack or reconnaissance or anything. This is foreign language to them, right? So there's no overlap. Now at some point you do need to have overlap, but they don't need to understand the difference between a vulnerability and an exploit. They really don't.
Oh yes, they do. Oh, they absolutely do.
No, no, no. The CISO's job is to talk about risk.
No, never, never.
We throw that word around way too haphazardly.
I'll say we do.
Risk can be a lot of things to a lot of different people.
Risk is unmeasurable and unknowable. You cannot go in and—
If you define what risk is, risk in this case is you not meeting your quarterly deliverables. Risk is risk of this amount of loss over time. You start couching that and you go, okay, Board, I'm gonna give you recommendations, but your job is to tell me what is acceptable. Is being hacked once a year acceptable? Is losing 25,000 records every 3 years acceptable?
Don't worry about it.
You tell me where your comfort level is, and I, as the CISO, will develop continually adjusting plans to meet that expectation. That's how you win long term.
Never. If you introduce risk into a board discussion, you're going to be right in the CFO's pocket. And he goes, oh, risk. Can you quantify that? And you'll make something up because you can't quantify risk. Nobody can about anything. But you'll say, yeah, you know, you lose a million in revenue. Okay. How much insurance do we buy? Because that's how you deal with risk.
That's one way. That's transferring risk. You can mitigate risk. You can accept risk. You can ignore risk or you can transfer risk. And I know you've been talking with Anton and he knows this stuff too. And if you tell him, oh, you can't quantify risk, right? Or Andrew Jockwith or Dan Geer, right? Or Wade Baker, they're gonna come back and go, well, hold on, hold on now. You know, you can't predict what happens tomorrow, but you can predict long-term and you can get within some ballparks. Ballparks good enough to make business decisions.
You will never predict the thing that takes you down and, and forces you to resign. You can never predict the black swans because they're black swans. So, so it's me—
there's a whole book on that, right?
Yeah, it's me, it's me and that's been around for a while. It's me and Nassim Taleb against everybody else.
You ensure transfer the rest, right?
Can't do it, it's impossible. But we will have to agree to disagree.
Then I look forward, I look forward to the time where I'm coming to a board that you're sitting on and I'm giving a report out and recommendations and developing a strategy to the board, you and your peers. And I look forward to you grilling me. I mean, grilling me.
Just don't use the R word. Don't use the R word or I will tear you apart.
We have to. We have to because the reality is there may be a day, a month, or a year that we do nothing in security and nothing bad happens. And there may be a day or a month or a year where we do everything right and still something bad happens.
Not if you recognize the risk, right?
We have to then put parameters when we're talking about risks, and we can, right? We've got a lot of luminaries out there that— and it takes a lot of work, and it's not 100%, but it gives enough information and guidance to be able to make good business decisions, right? And I can give you an example. I'll give you an example. So while I was at Intel, you had mentioned Intel, I managed security for all their mergers, acquisitions, divestitures, site closures, and collocations around the world, about 120 deals I was involved in, right? So when I was running security, especially for the big projects, I would actually do a weekly report out, right, to the senior M&A managers. And the first maybe 2 weeks, I would go in there and say, okay, here's our risk, you know, where we're at, where we wanna be. And based on that, here are the most likely attacks we're going to have, right? Based on threats, based on, you know, everything else, internal, external, there's all, I won't get into it. But here's the list of the most likely attacks. And given the controls that we have, right? Block some of those, but here's the residual risk, right? First couple of weeks they thought, okay, that's great, you know, and passed on, passed on. And over time, because of these highly contentious deals, bad things would happen. And after almost 2, 2.5 months, when I'm meeting with them now, I would go over and say, okay, this is what happened in the last week. And then I would overlay that with what I predicted. And in almost all cases, everything that happened was on my top 5 list. And from that point on, they realized, wait a second, wait a second, either through magic or brilliance, right? Somehow he's getting this right. When I would come in and say, these are our top 5 attacks, this is what we have in place, this is what I would like to put in place, I need your investment. Okay. Got it. And there wasn't a question. There wasn't a question. I built up the credibility. Was I 100% time correct all the time? No, but it was enough at the business scale to say, yeah, I don't want that bad thing to happen. Or this one down here, number 4, I'm okay with that. I'm okay, right? But they could make the decision, decide what to invest in, and then I went off and executed to it. And I did that on a weekly basis. So you can do that. It is possible. Now, I wouldn't recommend a weekly basis for a board. If you incorporate initiatives, you can. Hey, we're gonna expand out to this geography. Great, let's talk about risk and what you're acceptable with. Hey, we're going to build this new product. Great, let's develop that strategy and figure out the risk. Let's figure out what the right investment level is to define very clear security goals and let's pursue them.
