Chris Cooper’s Post

I walked into my first boardroom in 2001 armed with a 20-slide deck on risk mitigation. By slide 3, I’d already lost every CxO. Here's how I learned to flip the script: I used to enter C-suite meetings ready to talk security. I'd jump straight into topics like attack surface, technical debt, and risk mitigation… then wonder why half the room looked like they were waiting for the fire alarm to go off. One day, before meeting a CFO, I decided to flip it. Instead of coming in with my talking points, I asked him: “What are the 3 biggest things you’re trying to accomplish this quarter?” Simple question, but the shift was massive. He opened up: → plans for expansion into regulated sectors → aggressive push to improve EBITDA → preparing to pitch for PE funding And just like that, I knew exactly how to position my work. Instead of pitching XYZ tool, I said: → Here’s how we avoid being flagged in DD → Here’s how we reduce risk exposure on paper → Here’s how security helps make you funding-ready That conversation was a turning point. I realised that my role was less about risk and more about enabling opportunity. So when I meet with any CxO today, I never use a script. We just have an honest, structured conversation with one goal: Find out what they actually care about. Here’s how I approach each one: CEO: I want to know the mission and what's standing in the way. → Do they want to enter a new market or product line? → Are they trying to close a major partnership/acquisition? → Are there concerns about investor confidence? CRO: I want to understand their total view of risk. → What’s keeping them up at night? (legal, compliance, etc.?) → Are they struggling to quantify cyber risk alongside operational risk? → Are they under pressure to demonstrate risk maturity to regulators or clients? CFO: I want to know where the money’s going and why. → Are there deals being held up by security compliance? → Are they looking to reduce operating costs? → Do they need to impress potential investors? COO: I want to understand where operational friction is. → Is outdated tech slowing them down? → Are they dealing with service outages or failures? → Do manual processes make audits a nightmare? CMO: I want to get ahead of brand risk. → Are they planning customer-facing campaigns? → Do they rely on third-party data processors? → What’s the reputational impact if something goes wrong? My only agenda is to understand their agenda. Because they don't care about my password policy or my "urgent" need for a new XDR tool. All that is noise if I can't tie them to what they actually need to achieve. Security can absolutely be a growth enabler. But it has to be seen as aligned with the mission first. To any advisors trying to gain board-level support: Understand what they wake up thinking about, and figure out where security fits in. If you can’t speak the language of business, don’t be surprised when the business ignores your advice.