CISO Diaries

11 min read

How to connect cybersecurity learning outcomes to company goals

Aligning cyber performance with business objectives is vital to gain buy-in and investment from the board.

Mags22 avatar

Apr 17

Cybersecurity can’t afford to be a siloed function that operates independently of business objectives. Unfortunately, that’s the harsh reality for many security teams—silently protecting and defending, but never actually seen or heard. 

The truth is that earning a coveted seat at the executive table requires more than effective defense measures. To gain buy-in and support from leadership, security investments must align with an organization’s core priorities and goals. 

One key area of investment we’ve seen leaders struggle with is professional development and upskilling. When not tied explicitly to high-impact business outcomes, they’re often deprioritized during annual budget reviews with the C-level. 

Why do cybersecurity teams need to align with organizational goals?

align cyber training with organizational goals

Many cybersecurity teams are purely focused on technical goals. While board members and C-suite executives prioritize business goals, such as increasing the company's profitability, staying ahead of the competition, and being able to pay dividends to investors. 

As a result, cybersecurity leaders frequently struggle to illustrate the overall business consequences of potential security risks. This means security requirements often go unnoticed by executives and board members until a significant incident occurs.

The more cybersecurity professionals know about business outcomes, the better they understand the "why" of what they are protecting.

By connecting technical goals with strategic plans, we can achieve the following:

  • Risk management: Cybersecurity teams can tailor their efforts to address the specific risks that could have a significant impact on the organization.

  • Resource allocation: Cybersecurity resources, whether financial, human, or technological, can be directed toward protecting valuable assets.

  • Communication and collaboration: Cybersecurity teams need to collaborate with different departments and stakeholders within the organization. By aligning with organizational goals, cybersecurity professionals can better communicate the importance of their work, gain support from other departments, and foster a culture of security throughout the organization.

  • Compliance and regulations: Many industries are subject to specific regulations and compliance requirements related to cybersecurity. Aligning with organizational goals helps ensure that cybersecurity measures meet these regulatory requirements. This safeguards against crippling legal issues and the organization’s reputation. 

  • Demonstrating value: Cybersecurity is often seen as a cost center. By aligning with organizational goals, cybersecurity teams can demonstrate their value in contributing to the organization's success, protection of assets, and overall resilience. 

  • Crisis management: In the event of a cybersecurity incident, clear alignment with organizational goals enables a strategic and coordinated response. Cybersecurity teams can prioritize the recovery of critical systems and data, minimizing the impact on the organization's ability to achieve its goals. Federal teams can achieve this with HTB’s tabletop exercises (TTXs), to reenact a live crisis.

How to align cybersecurity upskilling with company goals

strategic cybersecurity talent development

Cybersecurity upskilling can significantly improve your organization’s security posture, but to align it with other key company goals, you need to decide on some key cybersecurity metrics to track and report to the board

Creating an effective cybersecurity upskilling program without understanding business goals is not impossible, but it is neither advisable nor effective.

Every business goal carries inherent risks, and cybersecurity teams can play a crucial role in mitigating these through targeted upskilling. By aligning upskilling efforts with business strategies, organizations can enhance their resilience and safeguard their operations effectively. 

This approach not only reduces vulnerabilities but also turns cybersecurity into a strategic asset.

Business objective 


Cybersecurity upskilling solution

Boost market trust and brand reputation.

A data breach could hugely impact customer trust. 

Invest in upskilling your existing cyber team to mitigate potential breaches.

Increase employee engagement. 

Losing employees could impact the security posture of your business. 

68% of security team members rated “opportunities to learn skills” as the most successful way of staying engaged at work.

Ensure secure adoption of cloud services.

Larger attack surface is more vulnerable to attacks.

Upskill your cybersecurity team in protecting Cloud infrastructure


The most significant security threats to your company often differ from those faced by others, largely influenced by the industry in which you operate. 

For instance, a healthcare organization might consider systems vital for patient care—its crown jewels—to be its most significant assets. Consequently, preventing unauthorized access to these systems is paramount. 

In contrast, a financial institution might prioritize safeguarding credit card details against theft.

Understanding these crown jewels is crucial in helping you allocate your security resources effectively and measure the performance of your cybersecurity initiatives. This insight also enables strategic planning for upskilling and talent development within your security team, ensuring that critical knowledge gaps are identified and addressed.

Assess recent cyberattacks in your industry and past incidents the organization has faced, to see what lessons can inform your goal-setting process. This will highlight the most relevant risk areas to protect.

Conduct an in-depth risk assessment to evaluate your existing security measures and protocols. This will enable you to pinpoint any weaknesses or deficiencies in your current system that can be addressed through upskilling initiatives.

These risk scenarios can then be emulated through tabletop exercises (TTXs) and Capture the Flag (CTF) events. 

For example, a TTX could test your security team’s preparedness by asking how they’d prepare for a suspected attack on your organization’s most critical assets. Discussion questions could include: 

  • What are the potential threat vectors?

  • Have you considered which attack vectors have been most common over the past month?

  • Have you checked your patch management status?

  • Can you increase the monitoring of your IDS and IPS?

  • Do you have a way of notifying the entire organization of the current threat?

  • Does your incident response plan account for these types of situations?

Prepare for risks with Hack The Box CTFs

  • Build your own CTF: More than 55 challenges and curated packs relevant to your team’s needs.

  • User progress report: Straightforward graphs will help you gain a better understanding of your team’s performance.

  • Benchmark: CTFs enable you to gain an overview of your team’s weaknesses, and plan upskilling initiatives in these areas.


4. Compliance and regulatory requirements

cybersecurity assessments compliance

To effectively argue how upskilling in cybersecurity has a direct and indirect relationship with compliance and regulatory requirements, it's essential to focus on the specific ways in which developing cybersecurity skills can help an organization meet governmental standards and regulations. 

Here’s how you can make a compelling case:

Direct influence of upskilling on compliance

  1. Skill alignment with compliance standards: Upskilling programs can be designed to directly address specific regulatory requirements. For instance, if compliance standards require regular risk assessments, training employees in advanced risk analysis techniques ensure that these assessments are performed effectively and according to the latest methods.

  2. Certification and standardization: Many regulations require that certain tasks be performed or overseen by certified professionals. Upskilling programs can help employees gain these necessary certifications (e.g., CISSP, CISA, etc.), directly supporting compliance efforts.

  3. Enhanced audit preparedness: A well-trained cybersecurity team is better equipped to handle audits and regulatory inspections. Training in areas like incident response and data protection can streamline the audit process by ensuring that employees know how to provide the necessary documentation and evidence of compliance.

Indirect influence of upskilling on compliance

  1. Cultural shift towards compliance: Continuous upskilling fosters a culture of security awareness and compliance. When employees understand the importance of regulations and are trained in compliance-related processes, they are more likely to adhere to these standards in their daily activities.

  2. Adaptation to regulatory changes: The regulatory landscape is constantly evolving, and upskilling ensures that the cybersecurity team remains current with the latest compliance requirements and technology standards. 

  3. Innovation and compliance enhancement: Upskilling can lead to innovation in cybersecurity practices that not only meet but exceed regulatory requirements. For example, training in emerging technologies like AI and machine learning can lead to the development of more sophisticated security measures, which can set new standards in compliance and industry best practices.

Practical application

Implementing upskilling in line with compliance needs can be particularly practical. For example, penetration testers and security auditors can undergo specialized training to understand and implement controls which are aligned with specific regulatory frameworks such as GDPR, HIPAA, or SOX. 

This tailored training ensures that the security measures and controls are not only compliant but are also effectively guarding against relevant threats.

By directly linking upskilling programs with compliance requirements and demonstrating how they improve compliance outcomes, you create a strong business case for ongoing education and development in cybersecurity.

5. Learn how to communicate these goals with the board of directors

When communicating the benefits of upskilling to the C-Suite and board of directors, it's crucial to align your message with their strategic goals and demonstrate how upskilling can be a key driver of long-term business success. Here's how you might approach it:

  1. Connect upskilling to business objectives: Start by linking upskilling directly to critical business outcomes. Explain how enhanced skills lead to better risk management, faster threat detection, and more efficient problem resolution, which can all safeguard the company’s assets and reputation.

  2. Illustrate indirect benefits: Highlight the indirect benefits of upskilling, such as increased employee engagement and retention, which are important to the C-Suite. Emphasize that a more skilled workforce can lead to innovation and a stronger competitive edge, ultimately enhancing market trust and brand recognition.

  3. Use data and trends: Provide data or case studies from similar organizations that have seen success from upskilling initiatives. This evidence can make a compelling case for the potential return on investment.

  4. Address skill gaps: Identify current skill gaps and how they pose risks to achieving strategic goals. Outline a detailed plan for how upskilling can address these gaps.

  5. Propose a pilot program: Suggest starting with a pilot upskilling program in a critical area. This approach minimizes initial investment and provides tangible examples of potential benefits before a full rollout.

  6. Emphasize agility and resilience: Stress that upskilling contributes to organizational agility and resilience, enabling the company to adapt more quickly to market changes and emerging threats.

  7. Show long-term vision: Align the upskilling initiative with the long-term vision of the organization. Show how continuous learning and development are crucial in keeping pace with technological advancements and industry standards.

  8. Call to action: Conclude with a clear call to action, such as setting up a committee to explore upskilling strategies or approving a budget for training programs.

By using these strategies, you can effectively communicate the importance and benefits of upskilling to senior leadership, fostering a culture of continuous improvement and innovation within the organization.

Cybersecurity posture checklist

The results of your cybersecurity development initiatives should be reported to the board in such a way that demonstrates how upskilling in a certain CVE, for example, led to a patch that prevented the vulnerability from being exploited, thus protecting the organization’s reputation.

Remember, the board isn’t interested in the ins and outs of cybersecurity learning, as long as it has a positive impact on the above metrics, and a line can be drawn between the two.

Plan upskilling according to business objectives

After taking into account everything relating to key business objectives, you can begin to plan a comprehensive upskilling program that will not only improve security posture but keep your security team engaged. 

Most business objectives relate to reducing risk, and upskilling is one of the best ways to reduce risk, whether it’s faster response times, reducing burnout, or remaining compliant, it’s an essential piece of the cybersecurity puzzle.

Achieve business success with HTB Enterprise Platform

  • Risk mitigation: Timely content offers training on the latest CVEs in real-world environments, reducing risk and exposure to these vulnerabilities.

  • Employee retention: Cybersecurity teams that are offered upskilling opportunities are far more engaged and less likely to burn out.

  • Performance benchmarking: Conduct CTFs and gap analysis to identify weaknesses in your security posture.

  • Workforce development: Align organizational goals to your cybersecurity KPIs with content categorization and report your success metrics to the board.

  • Tailored training to industry standards: HTB content is mapped to MITRE ATT&CK and NIST NICE frameworks so you can assess your cyber preparedness in different areas.

  • Boost organizational awareness: HTB can assess cyber readiness and performance company-wide with effective practices like tabletop exercises (TTXs) or nearly practical assessments designed for security staff and non-technical teams.


Dan Magnotta (Mags22), HTB Federal Business Development & Capture Manager, Hack The Box

Dan Magnotta is an accomplished professional in cybersecurity and intelligence operations with more than a decade of experience in the military and private sectors.

His career began with dedicated service to the U.S Department of Defense, where he played critical roles in the U.S. European Command and U.S. Special Operations Command Europe, contributing significantly to cutting-edge cyber strategies.

In addition to his civilian role, he serves as an LCDR in the U.S. Navy Reserve, showcasing his leadership and dedication as an Executive Officer for a Navy Reserve Unit. His expertise in cybersecurity, operational analysis, and strategic planning is extensive.

At Hack The Box, he tailors solutions to meet the unique requirements of government agencies and organizations worldwide, leveraging his deep understanding of both military and civilian cybersecurity needs.

Hack The Blog

The latest news and updates, direct from Hack The Box