The language barrier that costs millions

Why security teams and boards fail to communicate – and how to fix it

Your board approved a £50,000 security project and rejected a £300,000 one. Six months later, a breach — that the rejected project would have prevented — cost £4.2 million.

The approved project came with clear profit projections. The rejected one talked about ‘advanced persistent threats’ and ‘zero-day vulnerabilities’ — jargon that means nothing to people who think in terms of money and percentages.

This cycle repeats because two critical groups within the same organisation speak fundamentally different languages.

What drives this communication breakdown?

Mismatched priorities: Security teams focus on technical vulnerabilities and threat landscapes. Boards focus on commercial outcomes and competitive advantage. Neither translates their concerns into the other’s framework.

Different risk perspectives: Security professionals assess probability and technical impact. Business leaders evaluate commercial consequences and strategic implications. These frameworks rarely align without deliberate effort.

Incompatible metrics: Security teams present vulnerability counts and threat intelligence. Boards need revenue protection estimates and competitive positioning data. The gap between these measurement systems creates mutual frustration and poor decision-making.

These differences in language and perspective create more than just frustration — they generate measurable business consequences that compound over time.

The cost of miscommunication

Organisations that fail to bridge this language barrier face three critical consequences:

• Misallocated security investments: Resources flow toward projects that feel important rather than those that protect essential business functions. Critical vulnerabilities remain unaddressed while visible but less impactful security measures receive funding.
• Ineffective incident response: When breaches occur, security teams advocate for comprehensive remediation while boards prioritise rapid business resumption. This tension delays both technical recovery and business continuity, extending damage and increasing costs.
• Missed commercial opportunities: Effective security programs create competitive advantages, enable new partnerships, and support regulatory compliance that opens market opportunities. Organisations that cannot articulate these benefits in commercial terms fail to capitalise on their security investments.

Breaking this cycle requires more than good intentions — it demands a systematic approach that gives both sides the tools to speak each other’s language.

Bridging the Gap: A Translation Framework

The solution requires both sides to adopt shared language that connects technical realities with business outcomes.

For security teams: Commercial impact communication

Transform technical assessments into business language:

Technical statement: “We have identified 85 critical vulnerabilities across our infrastructure.”

Business translation: “Attackers could access customer data within four hours of targeting our systems. Similar breaches in our sector typically cost £2-3 million in direct recovery expenses.”

Technical statement: “Multi-factor authentication implementation is essential for account security.”

Business translation: “This £50,000 investment prevents account takeover attacks that average £200,000 per incident in recovery costs and customer remediation.”

For executives: Security-aware questioning

Evaluate security proposals using business-focused criteria:

What specific business problem does this address? How does this protect revenue, reduce costs, or enable growth? What commercial consequences follow if we defer this investment? How do we measure success beyond technical metrics? What alternatives exist, and how do their costs and benefits compare?

Risk translation methodology

Create a standardised risk translation table that connects technical threats with business impact, for example:

Threat Scenario	Business Impact	Annual Probability	Estimated Cost	Prevention Cost
Server infrastructure failure	Sales operations stop for 6-8 hours	30%	£500K	£50K
Credential compromise	Customer account breaches	15%	£300K	£25K
Ransomware deployment	Complete system lockdown for 3-5 days	40% if targeted	£2M	£75K
Insider data theft	Regulatory fines, litigation, reputation damage	5%	£1M	£40K

Create this framework to reflect your organisational risks, and update based on emerging threats and industry intelligence. Use it consistently in security discussions to maintain shared understanding between technical and business stakeholders.

While the risk translation table provides the foundation for shared understanding, organisations must go further by embedding this common language into regular operations.

Implementation approach

Monthly reporting standards: Present security metrics in commercial terms. Highlight prevented losses, improved customer confidence scores, and regulatory compliance achievements that enable new business opportunities.

Scenario-based planning: Conduct regular exercises that simulate realistic threat scenarios. Practice decision-making processes that balance technical requirements with business continuity needs.

Investment justification process: Connect every security investment to measurable business outcomes. Demonstrate how proposed spending protects existing revenue, enables new opportunities, or reduces operational risk.

Start the Translation Today

The next board meeting shouldn’t be another missed opportunity to align security investments with business protection. Here’s how to begin bridging the gap immediately:

For security leaders: Before your next budget presentation, choose three current vulnerabilities and rewrite them using the commercial impact framework above. Test these translations with a trusted business colleague — if they don’t immediately understand the business risk, revise again.

For executives: In your next security briefing, ask these three questions: “What revenue does this protect?”, “What’s our cost if we’re wrong?”, and “How will we measure success?” Don’t accept technical jargon as answers.

For both sides: Schedule a 90-minute workshop within the next month. Use the risk translation table to evaluate your top five security concerns together. Practice the conversation you’ll need during an actual incident — because the middle of a crisis is too late to establish shared language.

The organisations that master this translation will make smarter security investments, respond more effectively to threats, and turn their security programs into competitive advantages. Those that don’t will keep repeating the expensive cycle of miscommunication and missed protection.

The question isn’t whether your organisation will face a security incident — it’s whether you’ll be prepared to make the right decisions quickly when it happens. That preparation begins with a conversation, and that conversation starts now.