# Exercise: "Risk Translation"

Practice converting these technical risks into business terms:

- Technical: "Our web application has SQL injection vulnerabilities in several input fields." 
- Business: "Our customer portal has weaknesses that could allow attackers to access our customer database, potentially exposing personal and financial information that would trigger regulatory reporting requirements and damage customer trust."
- Technical: "We lack adequate network segmentation between operational technology and IT networks." 
- Business: "Our manufacturing systems are connected to our corporate network in ways that could allow a security incident to spread from office systems to production facilities, potentially causing production outages costing $500,000 per day."
- Technical: "Our current intrusion detection system has limited visibility into encrypted traffic." 
- Business: "Our ability to detect potential data theft is limited, creating a risk that sensitive information could be exfiltrated without detection, potentially leading to competitive disadvantage and intellectual property loss."

This translation exercise helps bridge the gap between technical and business perspectives, ensuring that security concerns are understood in terms of their business implications.

***

(c)[Kayne McGladrey](https://kaynemcgladrey.com/) - [Get the full book "Cyber Risk is a Myth"](https://www.routledge.com/Cyber-Risk-is-a-Myth-A-Business-Approach-to-Integrated-Risk-Management/McGladrey/p/book/9781041249054)