Communicating Cyber Risk

Cybersecurity is often presented as a technological challenge: protecting computer networks, preventing attacks and investing in increasingly sophisticated security systems. Yet even the most advanced technology may prove inadequate if organisations cannot interpret threats, communicate their consequences or respond effectively. What role does communication play in building cyber resilience, and why should it matter to business leaders as much as to cybersecurity specialists?

In this episode, Bernardo Bátiz-Lazo speaks with Nina Paine and Ashley Sweetman about Communicating Cyber Risk: Build Cyber Resilience Through Compelling Communication (Kogan Page, 2026). They discuss the book's origins and the distinction between cybersecurity and cyber resilience. Their conversation examines the role of organisational structures and management practices in shaping responses to cyber threats, as well as the challenges of communicating risk across organisational levels.

Particular attention is paid to the financial sector, where banks depend on interconnected technological infrastructures, payment networks and external service providers. The discussion considers what makes cybersecurity particularly challenging in banking, how multinational financial institutions navigate diverse regulatory environments and organisational cultures, and whether lessons from large international banks can be applied to smaller financial institutions and fintech companies.

The interview also addresses the relationship between organisational and systemic resilience. Financial institutions do not operate in isolation, and cyber incidents can have consequences extending well beyond individual firms. This raises questions about the responsibilities of banks, regulators, governments and other participants in the financial system, as well as the challenges of sharing sensitive information across institutional boundaries.

Drawing on the authors' professional experience and their interviews with senior cybersecurity practitioners, the conversation considers what their research reveals about organisational responses to cyber risk and the extent to which these findings can be generalised across different institutional settings.

Ultimately, the book invites readers to think about cybersecurity not simply as a technical responsibility but as an organisational challenge involving leadership, communication and the management of risk in an increasingly interconnected world.

References and further reading: 
Arsenault, B. (Host). (2021, July 7). Leading an inclusive workforce: Emma Smith, Vodafone (No. 8) [Audio podcast episode]. In Security Unlocked: CISO Series with Bret Arsenault. Microsoft; The CyberWire Network. here

Bátiz-Lazo, B. (Host). (2022, November 1). Ashley Sweetman, "Cyber and the City: Securing London's Banks in the Computer Age" (Springer, 2022) [Audio podcast episode]. In New Books Network. here

Kaplan, J. M., Bailey, T., O'Halloran, D., Marcus, A., & Rezek, C. (2015). Beyond cybersecurity: Protecting your digital business. John Wiley & Sons. here

Paine, N., & Sweetman, A. (2026). Communicating cyber risk: Build cyber resilience through compelling communication. Kogan Page. here

Smith, E. (2026, July 29). Trust in a connected world: Why cyber resilience matters. Vodafone. here

Sweetman, A. (2022). Cyber and the city: Securing London's banks in the computer age. Springer. here