Communicating cyber risk in dollars boards understand

Nick Nieuwenhuis argues that decades of cybersecurity investment overemphasize technical controls while neglecting socio-technical factors—people, processes, and organizational dynamics—leading to weak resilience; he highlights poor risk communication with boards, the limits of root-cause analysis in complex systems, and recommends investing in communication, rehearsed playbooks, and continuous learning to build true cyber resilience.