Can you walk us through what each of those things mean?

So the word set basically is communication, right? Either upwards to the board or to sea level or downwards to the operators and practitioners, right? So how is value being communicated? How are challenges being communicated? You first have to get that right.

And then that actually then points you to the tools that you need.

What tools do we need to try and solve that problem? So once you've actually got the kind of tool set, then you have the skill set.

So do we have the requisite skills to be able to actually run these tools, to be able to do what we need to solve the problem? So those three things come together as a kind of a summary of how to analyze that whole process.

How can security leaders better explain risk and priority to executives and the board?

The key takeaway to remember from all of this is ultimately the board, the C-level, what they're trying to do is to basically make a decision, right? Once you acknowledge that, that's the first piece.

What you need to try and do is to give them the right information, right? To make it far easier to make the decision as quickly as possible.