Risk Communication
Risk communication translates explainable prioritization into stakeholder language—impact, context, confidence, and recommended action—without jargon dumps or raw severity counts.
Risk Communication
What practitioners need to know
Practitioners ask: How do I explain prioritization to leadership? Why don't executives trust the VM report?
Risk communication translates explainable prioritization into language stakeholders act on—without CVSS dumps or alert volume metrics.
Audience-specific framing
| Audience | Needs | Avoid |
|---|---|---|
| Executives | Business impact, decision, resource ask | CVE lists, tool jargon |
| Application owners | Specific asset, fix window, consequence | Global severity stats |
| Auditors | Evidence, rationale, acceptance records | "We use best practices" |
| SOC peers | Context, evidence KIDs, next steps | Ambiguous "high risk" |
Communication structure
- Situation — what finding or theme
- Context — exposure, asset tier, threat (
KID-CON-0030) - Evidence confidence — validated vs assumed
- Risk rank rationale — why now, why first
- Recommended action — fix, accept, investigate
- Uncertainty — what we do not yet know
Industry context
Executive dashboards showing "500 Critical open" destroy trust. Dashboards showing top 5 explainable business risks with owners enable action—core to risk intelligence, not fear marketing.
Common mistakes
| Mistake | Consequence |
|---|---|
| Severity-only slides | Wrong resource allocation |
| No recommended action | Meeting without decision |
| Hiding uncertainty | Surprise when wrong |
| Different story to audit vs ops | Credibility loss |
Practical implications
- Use rank templates with business context fields.
- Lead with impact, support with technical detail in appendix.
- Align with investigation documentation standards (
KID-CON-0026). - Review messaging after major incidents for calibration.
Limitations
Stakeholders may still demand "fix all Criticals." Document trade-offs and acceptance paths (KID-CON-0032) rather than overpromise.
Related knowledge
| KID | Resource |
|---|---|
| KID-CON-0035 | Business Context in Risk Decisions |
| KID-FAQ-0019 | How do analysts explain risk to executives? |
Authority references
KID-OIN-0001— operational views for stakeholder communication