Subscribe
Share
Share
Embed
Boards need enough cyber detail to judge exposure, understand whether key controls are working, and decide where intervention or investment is required.
Cyber lands better when it is framed around governance, business risk, and investment choices rather than technical complexity.
Jamie Rossato, CISO at Orica Australia, shares a practical view on how security leaders build alignment with boards and executives by connecting cyber outcomes to risk appetite, operational priorities, and the cost of leaving gaps unresolved.
Key takeaways:
- Effective board engagement depends on clarity, brevity and aligning cyber discussions to fiduciary responsibility and risk appetite.
- Investment decisions are won at the executive layer, where operational ownership and funding decisions are shaped.
- A threat-led approach strengthens both security posture and compliance outcomes, making cyber spend easier to justify.
Board engagement demands clarity, not complexity
Communicating with boards requires direct, concise messaging focused on controls, risks and outcomes, not technical detail.
Boards operate under time pressure and broad accountability, so cyber leaders must translate security into governance, risk and fiduciary impact.
Jamie emphasises avoiding overly dense materials, instead focusing on whether controls are effective, aligned to risk appetite, and what actions are in place to address gaps.
Executive alignment is where investment is won
Cyber funding conversations are secured with executive management before reaching the board.
Executives own implementation and operational risk, making them critical partners in shaping, supporting and advocating for cyber investment.
Jamie notes that by demonstrating control effectiveness and value for money, leaders guide executives to recognise unaddressed risks, naturally building the case for further investment.
A threat-led strategy outperforms compliance-first approaches
Focusing on real threats ensures security measures are meaningful, with compliance emerging as a by-product rather than the objective.
Compliance alone can drive checkbox behaviour, whereas threat-led strategies prioritise actual risk reduction and resilience.
Jamie explains that understanding internal and external threats allows organisations to meet regulatory requirements organically, while also making a stronger case for proactive investment, even when threats have not yet materialised.
Cyber leaders create influence not by amplifying risk, but by demonstrating control, value and foresight in a language the business already understand.
Creators and Guests
What is ADAPT Insider?
This is ADAPT Insider. Proudly A/NZ first. For more than 15 years, ADAPT has empowered Australia and New Zealand’s executive community with trusted data, insights, and connections so leaders can make better decisions with confidence. Because this region is different. Our markets are unique. And the challenges facing enterprise leaders from legacy technology to transformation are only getting bigger. Each year, through in-depth research, benchmarking and executive-only events, ADAPT engages with over 2,000 senior leaders across the region’s most influential enterprise and government organisations. ADAPT Insider brings you inside those conversations. Real perspectives from technology and business leaders. Independent research grounded in local data. And practical intelligence you can actually use. This is not theory. It is insight for leaders driving modernisation. Welcome to ADAPT Insider. Built for A/NZ leaders. Backed by data. Designed to help you move with confidence.