Storytelling: A CISO’s Superpower Against Cybersecurity Indifference

The popularity of storytelling is astonishing. It’s rare to find a TED session without an expert explaining the miraculous power of storytelling to give us influential superpowers, and YouTube is full of tips and techniques for storytelling.

However, most of these lectures are aimed at improving presentations on the main stage or increasing the effectiveness of marketing campaigns. And while these are really valuable – a charity doubled donations simply by displaying the message in a story – they seem disconnected from the reality of the CISO role and the day-to-day stress we face. So how can we adapt storytelling to support our goal of better communicating the need for cybersecurity?

The benefits of storytelling

There are many positive outcomes that come from a well-told story. Listeners can remember details and facts much better, often hear more and listen longer.

Stories give the presenter the opportunity to wrap boring messages in appealing packaging; they slow down the thought process, which helps build credibility and trust; and they build emotional connections that attract people and encourage positive participation and decisions.

Cybersecurity stories can be the connective tissue between a problem, your question and a positive outcome. All of these benefits should be the aspiration of every C-level executive.

How does it work?

There is no shortage of people willing to explain how storytelling can work. Everyone should find their own model that works for them. However, when consuming hours of that content in research, certain key components stand out.

Build a common foundation

Show understanding for the situation of the listeners, whether they are interns or board members, so they know this story concerns them and deserves their attention. To accomplish this, many story presentations begin with an interaction with the audience, something like “How many of you have/feel/think…” This immediately establishes a collective agreement about a core component of the story. It provides a solid foundation for the scenario you are going to build.

Paint a vivid picture

Stories talk about emotions, and emotions take the lead in decisions, followed by facts that are used to justify those decisions. We need to create a drama that appeals to the audience. This may be the classic “hero’s journey”, but a simple story about the reversal of fate is enough, if it is described in detail. No matter how senior, the listener will still respond more positively to a human drama than to just a business drama, so create recognizable personalities at the heart of your story.

Unleash the power of contrast

As part of your vibrant photo, it’s important to describe what: is versus what? could be. Display an image of the world on the current path, and an image with that path changed. Connect this to the characters in the story to make the potential change in the world feel real and recognizable.

Give a proposal

The success of a corporate storyteller depends on getting approval for the desired outcome, so make your proposal clear. The story should show how your solution makes sense, how it accommodates and addresses the danger you described, and how it will turn the outcome of the story into a positive one.

When do you use a story?

With compelling benefits and a logical model, it’s ideal to take on a story related to CISOs. The challenge I see is when and where this applies, beyond the main stage keynotes and marketing focus.

There are several suitable options.

Promoting behavioral and cultural change

Perhaps the most appropriate scenario for storytelling is when you talk to business units about security awareness and behavior change. People will subconsciously copy characters they can identify with, so sketching a story of danger and cyber-impact, and then offering an alternative path, can create a dominant learning opportunity — especially if you back that story up with real-life examples.

Explain a complex situation to C-level executives

Wrapping the fact-based story in a story is a better way to communicate, influence and encourage information retention. The compelling Zeigarnick effect shows that people remember even fine details until a story reaches its completion, and other studies show that facts are 20 times more likely to be remembered when told in story form.

Send a business decision

By creating the emotional entanglement that a story can create, you can better influence business decisions. Creating stories as hooks to ensure that staff at all levels of seniority can remember and interact with a driver for a change will protect that initiative from being diverted or defunded. Use the story in your top-level presentation, but then drop it down as a summary of what the decision is and why.

Create credibility and trust

We have all used examples from our own careers to build credibility and trust with our board of directors. This is our natural use of storytelling that emerges, so use the same process more consciously to build relationships across the enterprise.

The lasting power of a good story

Storytelling is a natural act that people can relate to, and it has always been part of human nature, so it’s no surprise that it remains one of the most effective communication models. Business can often overwhelm our natural instincts with data and analytics. However, as security leaders, our role is increasingly centered on influence and relationships. Essentially, storytelling is still in vogue because of its underlying power.

Andrew Rose is resident CISO, EMEA, at Proof.