How Security Teams Can Earn Board Trust With Exposure Management

 

TL; DR

Learn how transitioning to an AI-driven exposure management strategy enabled Tenable’s Chief Security Officer, Robert Huber, to conquer software sprawl, integrate fragmented data, manage the risks of rapid AI adoption, and pivot from sharing highly technical statistics to conveying corporate risk in a way that executives and board members can easily comprehend.

 

Key Takeaways

• A comprehensive exposure management program equips security leaders with the precise insights they need to explain to the board how the organization is effectively mitigating cyber risk.
• Evolving from traditional vulnerability management to exposure management allows security teams to protect organizations’ increasingly complex and rapidly expanding attack surfaces.
• Converting raw security data into intuitive cyber risk indicators tied directly to business unit revenue streams allows CISOs to give the board clear answers to foundational questions such as: “Are we secure?”

 

---

How do we define trust in cybersecurity? Furthermore, how do we establish it?

Spoiler alert: It is exceptionally difficult, particularly during this AI era.

As Tenable’s CSO, my primary objective is to guarantee that our organization operates securely, while simultaneously maintaining the velocity necessary to thrive within a fiercely competitive environment.

Over the past few years, striking this precise balance — an agile yet cyber secure business — grew steadily harder, especially while we struggled against segmented data, siloed teams, and security tool sprawl.

Throughout this article, I will detail how adopting exposure management helped my department in:

• Tackling security tool sprawl
• Connecting operational and data silos
• Adopting a significantly more preventative security approach
• Gaining visibility and control over our attack surface
• Consistently and accurately evaluating our cyber risk posture

 

How Data Silos and Tool Sprawl Hamper Your Security Program

Historically, the cybersecurity industry’s typical response to any new threat or regulatory requirement was straightforward: Purchase another tool. In many, perhaps a majority, of companies, this led to a bad case of tool sprawl. A typical large enterprise could easily have upwards of 70 distinct security software providers, all pledging to fix a unique issue. My staff here manages around 50 different security tools.

We found ourselves in a situation where siloed teams were running siloed tools, with separate views, prioritization criteria, key performance indicators, remediation workflows, and reporting.

To illustrate this internally, I used to present a visualization of our architecture that I called the “spaghetti chart.” It was a tangled web of inputs from endpoint detection and response (EDR) vendors, bug bounty programs, vulnerability scans, security operation center (SOC) findings, penetration tests, and more.

Each tool demanded its own unique workflow. As you can see, the spaghetti chart presented a picture of chaos. It reminded me of Gen. Stanley McChrystal’s quip regarding a spaghetti chart he was presented with during the war in Afghanistan: “When we understand that slide, we’ll have won the war.”

Similarly, we could have said: “When we understand that chart, we’ll have eradicated cyber risk.”

The ramifications of this fragmented security approach became painfully clear whenever I presented to the board of directors. During a specific board session, I showed up carrying a presentation containing 45 distinct slides. A grueling 30 of those were crammed full of metrics, KPIs, and raw data.

My colleagues put in an immense amount of effort to consolidate those details and craft a cohesive story. However, I had to confront a harsh reality: A large portion of our corporate executives and board members simply didn’t grasp the numbers. Whenever you share strictly technical statistics, such as the total count of unpatched flaws or the volume of devices scanned, the C-suite quickly tunes out. These figures fail to convey any real business impact.

 

Two Key Questions Cisos Must Answer When Presenting To The Board and C-suite

When interacting with senior management and the board of directors, I am typically presented with two fundamental questions.

First: “Are we secure?” I may also get asked a variation, such as: “What’s our exposure?”

Relying on my 30 data-dense slides — produced by upwards of 50 tools with their own disparate reporting functions — I somehow needed to boil the ocean of data and make a judgment call as to how secure we actually were.

The second question I frequently hear is: “How do we compare to peers?”

Being a publicly traded cybersecurity company, we have a strict fiduciary responsibility. The directors want to guarantee that we are maintaining a reasonable cybersecurity standard of care. Are we doing the things we’re supposed to be doing, that are expected of us by our shareholders, customers, and partners?

My role involves taking those 50-plus tools, compiling every KPI, and produce a meaningful assessment of Tenable’s cyber exposure that leadership can easily understand. We have multiple lines of business aligned by different products, regions, and services.

True cyber risk management means being able to answer questions like:

• What is the associated revenue tied to each individual line of business?
• What level of cyber risk does each one face?
• How can we most effectively mitigate this risk?

Lacking business context, it’s impossible to effectively rank priorities.

 

How a Fragmented Security Stack Slows Business

Unfortunately, the siloed nature of our security architecture created friction not just at the top, but across the entire business. When my team reached out to engineering and IT leaders, we often handed them many fragmented reports and manual spreadsheets for each security domain, including cloud security, vulnerability management, app security, pen testing, compliance auditing, and more.

The problem arose when these engineering leaders, who have critical day jobs building and maintaining our products, looked at me and asked: “Bob, what the heck do you want me to do? What do I start with? How do I prioritize that?”

Coordinating reporting, mitigations, and remediations became a huge challenge. It didn’t scale well for my security teams, and it certainly didn’t scale for the receiving engineering teams, whom we hit up every week for their time.

 

AI: The Newest Obstacle for Managing Cyber Risk

Subsequently, AI shifted the paradigm once more. Each morning resembles Groundhog Day: you rise from bed, and the absolute latest AI feature materializes out of thin air.

As our internal usage of AI accelerated, our potential attack surface continued to expand. We knew we needed to manage AI security risks alongside traditional cyber risks. We also knew we needed visibility and context to make informed decisions about which AI security risks we were going to accept so that we could continue to move at the speed of trust. But I knew our old, siloed approach was untenable at the speed we needed to operate.

 

How Exposure Management Changes the Conversation Between CISOs and Leadership

To truly unify our risk posture, we fundamentally changed our organizational structure. We evolved our vulnerability management team into an exposure management team. We consolidated all our security areas into a single foundational exposure management policy.

Rather than simply managing traditional CVEs, the exposure management policy had to encompass a wider range of security issues, including misconfigurations and identity weaknesses, across the enormous, modern attack surface: identity systems, cloud workloads, AI tools, on-prem assets, the application development pipeline, and more.

Expanding the mandate of the vulnerability management team to encompass all forms of exposure represented a colossal operational shift, but notably, it didn’t increase our headcount. Rather, by centralizing our data, other specialized teams, like cloud security and application security, got time back to focus on securely deploying infrastructure rather than chasing down colleagues for patch management.

The exposure management team became the centralized “go-get-’em” team across the board. They don’t operate all 50 tools, but they are the ones who triage everything.

Subsequently, I tasked my exposure management team with solving the fragmentation problem. We grappled with the issue of “build vs. buy.” Should we dump all of the data from all of our different tools into a giant data store, and try to add analysis, workflow and reporting to that? Or should we look for alternative, out-of-the-box solutions that might already exist?

In the end, we decided not to build it ourselves, largely because building and maintaining a data warehouse is not our core competency, and it can get very costly, very quickly, with infrastructure, data costs, and specialized staff. Rather, we evaluated a bunch of vendors that could help us centralize our risk data with existing SaaS solutions.

We chose one specific solution that best fit our integration and workflow requirements. Eventually, we ended up acquiring the entire company, Vulcan Cyber, for these same reasons. And today, it is a foundational part of our exposure management platform.

As a result of shifting to an exposure management approach and consolidating security data within a single platform, the “spaghetti” chart got transformed into this:

 

Translating Exposure Into Simplified Metrics

The manifestation of this exposure management journey within our own platform is what my team affectionately calls “Bob’s simple metrics.” We established a direct visualization using the traffic-light protocol: the colors red, yellow, and green to categorize the level of cyber exposure for each of our lines of business. Red signifies critical risk. Yellow means it needs attention. Green indicates a healthy security posture. We aggressively tagged assets to contextualize them, tying specific infrastructure directly to business units and revenue streams.

We also automated the identification of what I call the “big rocks.” For example, if we can’t patch an asset because of system instability, our platform flags this as a systemic root-cause issue rather than just blindly listing individual vulnerabilities. We now have customized service level agreements (SLAs) tailored by region and business impact, enabling teams to track their performance against these targets effortlessly.

 

Frequently Asked Questions

How does an exposure management program differ from traditional vulnerability management?

Traditional vulnerability management assesses, ranks, and remediates individual vulnerabilities, often using industry-standard scoring like CVSS for prioritization. An exposure management program expands visibility across your entire attack surface, including vulnerabilities, misconfigurations, and permissions. It maps and prioritizes viable attack paths leading to mission-critical assets and data to break attack chains at scale. Exposure management is a fundamental shift from managing abstract security findings to a business-aligned quantification of organizational exposure.

 

How can security leaders translate technical cybersecurity metrics for executive board reporting?

Security leaders translate technical metrics into business risk by mapping asset vulnerabilities directly to revenue-generating business units. Establishing traffic-light scorecards using red, yellow, and green indicators helps executive board members understand organizational risk posture without sifting through granular operational spreadsheets.

 

What role does an exposure management platform play in overcoming security tool sprawl?

An exposure management platform consolidates data feeds from dozens of standalone security tools into a single normalized data repository. By aggregating telemetry across disparate systems, your security teams eliminate data silos and align remediation workflows across the organization.

 

How does proactive attack surface management address security risks from rapid AI adoption?

Proactive attack surface management provides continuous visibility into internet-facing assets, cloud workloads, and shadow artificial intelligence deployments. Identifying exposed AI services and overprivileged machine identities enables security teams to close high-risk attack paths before adversaries exploit them.