Cyber-Risk Communication and Executive Decision Quality

Lukas M. Schneider

Cyber-Risk Communication and Executive Decision Quality

Author(s)	Dr. Lukas M. Schneider
Country	United States
Abstract	Cybersecurity risk is increasingly an enterprise governance issue rather than an isolated technical concern. Senior executives and boards must make decisions about security investment, incident escalation, business interruption, risk acceptance, cyber insurance, third-party exposure, regulatory disclosure, and recovery priorities, yet the information supporting those decisions is frequently communicated through vulnerability counts, technical severity ratings, control deficiencies, and threat terminology that may not directly express consequences for enterprise objectives. Current NIST guidance explicitly connects cybersecurity risk management with enterprise risk management and emphasizes the need for directors and senior leaders to understand cybersecurity risk posture in relation to mission and business objectives. The December 2025 revision of NIST IR 8286 further strengthens the connection among cybersecurity risk registers, enterprise risk processes, governance, and executive decision-making. This study investigates how the format of cyber-risk communication may influence executive decision quality. Four hypothetical communication conditions were modeled: technical metrics only, traffic-light risk summaries, business-impact narratives, and integrated executive decision briefs combining threat scenarios, business consequences, uncertainty, risk appetite, residual risk, response alternatives, and explicit decision requirements. A synthetic experiment representing 480 executive decision episodes was constructed, with 120 episodes allocated to each communication format. Decision quality was assessed through risk comprehension, prioritization accuracy, decision confidence, timeliness, uncertainty calibration, and overall decision-support effectiveness. The integrated decision brief achieved the highest simulated composite score of 88.8, compared with 55.6 for technical metrics, 66.6 for traffic-light reporting, and 78.8 for business-impact narratives. The strongest condition also generated the lowest modeled misprioritization rate and the highest alignment between executive decisions and predefined organizational risk tolerance. The study does not argue that executives should receive less technical information. Instead, it proposes a layered communication architecture in which technical evidence remains auditable while the executive layer translates that evidence into scenarios, mission consequences, financial and operational exposure, uncertainty ranges, response options, residual risk, and a clearly defined decision. This approach is consistent with NIST's enterprise-risk guidance and with research showing that scenario-based engagement can reveal executive cyber-risk perceptions and preparedness more effectively than abstract technical discussion alone. The paper concludes that high-quality cyber-risk communication is not merely a reporting activity; it is a decision architecture that can materially shape how leaders allocate resources and respond to uncertainty.
Keywords	cyber-risk communication, executive decision-making, cybersecurity governance, enterprise risk management, board oversight, risk communication, cyber resilience, cybersecurity strategy, business impact, executive cyber literacy
Field	Engineering
Published In	Volume 3, Issue 3, May-June 2022
Published On	2022-06-30

View / Download PDF File

About AJAMIR Fees & Payment Current Issue Publication Archive	Submit Research Paper Track Submission Status Publication Guidelines Publication Ethics Peer Review & Plagiarism	Join as a Reviewer Editors & Reviewers Reviewer Referral Program Get Reviewer Membership Certi.	Website/Journal Policies Usage Policy Content Policies Privacy Policy

Contact Us		+1-872-302-3851	editor@ajamir.com

American Journal of Advanced Multidisciplinary Innovation and Research

A Widely Indexed Open Access Peer Reviewed Multidisciplinary Bi-monthly Scholarly International Journal

Cyber-Risk Communication and Executive Decision Quality

Share this