Andrey Biryukov, an independent IT and information security expert who teaches at training centers and authors books, examines why technically strong CISOs often lose internal battles despite superior expertise.
The typical scenario involves a capable CISO who has built a solid team and stays current on threats yet sees a predicted incident occur after budget requests were denied. In contrast, a less technical peer secures growing budgets, board attention, and cross-functional cooperation even after incidents. The difference, Biryukov argues, is the ability to sell the security program inside the organization—an undervalued soft skill rarely covered in certifications or interviews.
Why CISO Influence Matters More Than Formal Power
CISOs rarely possess direct authority over other departments. They cannot order the CFO to release funds, force business units to alter processes, or discipline developers who ignore security requirements. Their only tool is influence, which must be earned through trust, arguments, relationships, and political capital rather than granted by title.
Every security initiative requires decisions from others: funding, prioritization, acceptance of inconvenience, or process changes. When the CISO cannot sell these ideas effectively, initiatives stall, business units bypass security, budgets stagnate, and the CISO becomes the scapegoat after the first major incident.
Translating Security into Business Language
Business leaders operate under competing priorities. The CFO manages limited budgets across ten initiatives, the CTO faces release deadlines, and the CEO answers to investors. Abstract warnings such as “we could be breached” or “risk is critical” quickly lose impact. Effective communication instead uses concrete scenarios: lost clients, revenue impact in millions, weeks of payment-system downtime, and regulatory investigations lasting quarters.
Biryukov contrasts two requests for a new SIEM. The weak version states that the current tool covers only 70 percent of logs. The strong version explains that the blind spot affects systems handling 40 percent of payments, detection time would rise from hours to days, and one day of downtime would cost a specific amount while regulatory fines would reach another figure.
Building Coalitions and Narratives
Successful CISOs build relationships long before budget cycles through joint projects, informal conversations, and participation in other leaders’ initiatives. Political capital accumulated in calm periods is spent during crises. A clear narrative also helps: stating that in 18 months the organization will pass major client audits without exceptions and reduce cyber-insurance costs by a defined percentage, supported by specific initiatives such as identity management and segmentation, makes the program memorable and discussable even when the CISO is absent.
Objections are treated as invitations to further dialogue rather than walls. Asking “What would need to change for this to become a priority?” reveals the additional selling required. After incidents, a short window of attention opens; only CISOs who arrive with pre-calculated business cases capture new resources.
The article concludes that security programs without internal buy-in exist only on paper. Technical knowledge alone does not protect the organization; the ability to translate that knowledge into decisions by budget holders determines whether the program succeeds or the CISO becomes expendable.
