CISO vs CFO: why are the conversations difficult? – Source: www.csoonline.com

When CISOs walk into budget meetings they often ask for money to prevent abstract disasters: events that haven’t happened and hopefully never will. Unlike other executives who can draw a clear line between funding requests and generating revenue for the organization, CISOs deal in hypotheticals. They talk about potential ransomware attacks or data breaches that could expose sensitive customer and company information.

This is why convincing CFOs to invest heavily in cybersecurity to mitigate such threats can be difficult. More often than not, the conversation is riddled with frustration, miscommunication, and crossed wires. While CISOs frame cybersecurity as essential protection against looming threats, CFOs seek measurable returns and tangible outcomes, which can leave both sides struggling to find common ground.

“The hardest part has always been bridging the mindset gap,” says Darren Argyle, CISO, chairman and co-founder of the Cyber Leadership Institute. 

CFOs are used to dealing with concrete numbers, forecast models, and clearly measurable returns, but cybersecurity doesn’t work that way, he adds. “It’s more about reducing exposure to events that might happen, which often means the best outcome is nothing happens. That’s a tough sell.”

Although a single cyberattack can wipe out millions of dollars, CFOs and CISOs often approach cybersecurity from fundamentally different perspectives. Bridging this divide requires more than just better communication — it demands, as Argyle put it, a shift in mindset.

How can CISOs and CFOs meet halfway

The disconnect between CISOs and CFOs remains a challenge in many organizations. While cybersecurity threats escalate in scale and complexity, senior leadership often fails to fully grasp the magnitude of the risk. This gap is visible in EY’s 2025 Cybersecurity study, which shows that 68% of CISOs worry that senior leaders underestimate the risks.

Progress in bridging this divide happens when CISOs and CFOs are willing to meet halfway, aligning technical priorities with financial realities. Argyle realized that to move the conversation forward, he had to change his approach: he stopped defending the technology and started showing the impact. Instead of getting bogged down in technical jargon, he reframed cybersecurity in terms of financial risk, operational disruption, and bottom-line consequences. He also gave the CFO a hands-on view of the risk.

“We walked through a real-world ransomware scenario that tied system downtime to lost revenue, compliance fines, and reputational fallout. But instead of vague threats, we used actual financial models,” he says. “The CFO saw it less as a security issue and more like insurance for business continuity — and that was the unlock. We never had the same friction again after that.”

During these conversations, Argyle never promises ROI in the traditional sense, he is careful not to promise a traditional return on investment. Instead of selling cybersecurity as a way to make money, he frames it as a necessary shield against potential financial, legal, and reputational damage. “Cyber isn’t a shiny new tool,” he says. “It’s a seatbelt.”

During the conversation with the CFO or other senior executives, Argyle usually breaks it down into three buckets:

• What’s the cost of doing nothing?
• How does this reduce exposure or speed up response?
• Where does this investment support the broader business strategy?

This strategy is not about fear, he says, but “about framing cyber as an investment in the brand.”

Choosing the right words

Focusing on tangible things and tying cybersecurity directly to business outcomes can help CFOs see the bigger picture. Argyle experienced this firsthand when he pitched an investment in red teaming to his CFO. The initial reaction was sceptical. “You want us to pay to attack ourselves?” After a brief pause, Argyle reframed the proposal. “No — I want us to find the holes before someone else does.” The pitch landed. “The tone shifted once I framed it in terms of proactive risk management.”

Chithra Rajagopalan, head of finance at Obsidian Security, feels this approach has merit. She recommends that CISOs use clear examples that show “how security investments assist with financial planning stability and predictability across risk management (cyber insurance, tech upgrade cycles), fine reduction, regulatory approval for new market entry, and cyber staffing for business resilience.”

These conversations between CISOs and CFOs should be honest and open. Without transparency, everything can fall apart. Renee Guttmann, founder of CisoHive and former CISO for Coca-Cola and Campbell Soup, knows this firsthand. When she took over from a previous CISO, she sat down with the budget and quickly realized her team didn’t have the resources to deliver on everything that had been promised.

“When I met with the CFO, I was more realistic and the numbers, especially around resources and organization impact, were fleshed out,” Guttmann says. “Having a right-sized budget and plan was always important to me.”

Guttmann also recommends that CISOs get outside help if needed. A few times, she hired a boutique cybersecurity firm to make sure the board understood the stakes. Then, she had the findings validated by a Big Four firm the CFO trusted to help cut through scepticism and get leadership on board. “The CFO was much more comfortable having the risk, remediation activities, and costs reviewed by their trusted third party,” Guttmann says.

Building stronger bridges between CISOs and CFOs

Redesigning the relationship between a CISO and a CFO isn’t something that’s fixed over a single meeting or a strong cup of coffee. It takes time, mutual understanding, and open conversations. 

As Argyle points out, these discussions shouldn’t be limited to budget season, when both sides are already in negotiation mode. To truly build trust and alignment, CISOs and CFOs need to keep the dialogue alive year-round and make efforts to understand each other’s work, long before money is involved.

“Ideally, I’d bring the CFO into tabletop cyber crisis simulations and scenario planning,” he adds. “Let them see the domino effect of a breach — not just read about it in a report. That firsthand exposure builds understanding faster than any PowerPoint.”

Argyle recommends making interactions less transactional and more strategic, shifting the focus from simply justifying cybersecurity spending to co-owning risk alongside financial leadership. “That shift changes everything,” Argyle adds.

The CISO also recommends speaking the CFO’s language and using metrics they resonate with. This means offering information that ties to the outcomes they already care about, such as downtime, financial exposure, and compliance risk. Argyle suggests CISOs focus on cost per incident, scenario-based loss projections, downtime cost per hour/day, and third-party cyber risk exposure, and the cost of non-compliance. Whenever possible, CISOs should use dollar-based estimates. 

As a CFO, Rajagopalan sees value in this approach. “At Obsidian Security, one of the biggest ‘aha’ moments that we see for financial leaders comes when we show the gap between their rapid investment in SaaS and GenAI tools and the lack of equivalent security investment to protect them,” she says.

Another strategy is to compare the organization’s security program to those of the competitors, something Guttmann did a while ago. “I stated that I did not want to be the CISO of the best of the worst organizations in terms of cybersecurity posture,” she explains. “When I said this, I was actually permitted to benchmark the program against organizations that were seen as having stronger programs including those organizations that the board members were part of.”

All these boil down to one thing: while CISOs and CFOs might speak different languages, they have the same goal: keeping the business strong. CFOs shouldn’t see CISOs as obstacles but as allies who spot issues in advance and clear the path for safer growth.

“My job is to help the business move faster — but do it safely,” Argyle says. “The stereotype of the ‘department of no‘ is outdated.”