10 steps to building cybersecurity champions: how to gain executive support

Here’s a step-by-step guide to help you deliver your case. Prepare to educate and engage – without invoking the panic.

Your audience doesn’t need a crash course in malware anatomy, but they do need to know what’s on the line. Highlight high-impact risks, like the possibility of leaking patient data or compromising intellectual property. Use shocking cyber stats to your advantage – like the fact that the largest healthcare breach to date impacted 190 million records, nearly half the U.S. population [1]. Patient safety, financial losses and reputational damage suddenly make cybersecurity feel very real.

Executive audiences operate in terms of risks, rewards and bottom lines. So, frame cybersecurity in those terms. Explain how vulnerabilities can lead to service disruptions, regulatory fines and skyrocketing operational costs. Avoid cyber lingo unless you’re prepared to translate it immediately; saying "Reduced attack surface with Zero Trust Segmentation" without simplistically explaining it and what good looks like is how eyes glaze over.

Clearly and concisely break it down. Today, healthcare faces sophisticated, multi-layered attacks from nation-state actors and professional criminal organizations. The threats are evolving, too, with AI now powering phishing schemes and cyberattacks. Giving real-world context helps demystify the danger.

Explain the differences between reactive and proactive strategies, citing examples of successful approaches. Work with medical device makers manufacturers to enhance the handling and mitigation of potential security issues, use vulnerability management tools to track medical risks in one place and ensure key information is accessible, trackable, and visible to security teams and informative to others who need to know within the organization. Utilize threat sources like security advisories, MDS2 (Manufacturer Disclosure Statement for Medical Device Security) and SBOMs (Software Bill of Materials) to accurately monitor and address vulnerabilities. Highlight how methods like these lead to better preparedness, less downtime and fewer crisis-level incidents.

Provide a quick understanding of Cyber Threat Intelligence (CTI) – information related to detecting, preventing and responding to cyberattacks – especially its ability to keep your organization one step ahead of attackers. By leveraging CTI, both executives and technical teams can maintain secure, efficient operations and protect patient data. Frame CTI as a tool to enable smarter decisions and reduce last-minute fire drills. Using a brief analogy never hurts. CTI is like having a weather forecast for cyber threats – so you know when to grab an umbrella before it starts pouring ransomware.

Explain that strong cybersecurity isn’t just about buying the latest software; it’s about building resilience across the board. Discuss concepts like "Defense in Depth" multi-layered security and emphasize stringent controls, zero-trust policies and collaboration across all teams.

Cybersecurity doesn’t generate direct revenue, but it’s an investment that can prevent losses in the millions. Remind them how long-lasting downtime, lawsuits and regulatory fines (not to mention damaged trust with patients) could derail your organization. Show cybersecurity prevention as protecting – not draining – the budget.

People appreciate a good story. Highlight memorable examples, such as real scenarios from the healthcare industry or lessons from large breaches (like Change Healthcare’s [2]). A story of how a failure to patch a vulnerability led to chaos may resonate far more than yet another chart-filled PowerPoint slide.

Don’t overwhelm with technical details or endless options. Give two or three clear next steps, such as funding for assessing risks and applying risk reduction measures. Be specific about resource needs, timelines and expected outcomes.

Finally, position cybersecurity prevention as a competitive advantage. Frame it as an opportunity for your organization to lead in patient safety, compliance and operational quality, rather than just keeping up. Stress that their leadership on this issue will ensure the organization isn’t just surviving in the face of threats but thriving amidst them.

Remember, getting buy-in to resilient cybersecurity doesn’t require your executives to become cybersecurity experts – but by following these steps, you’ll help equip them with the knowledge and confidence to champion cyber-security best practice measures. And who knows? Instilling cybersecurity confidence and its criticality might just make it their new favorite topic...or at least, one they prioritize.