Oleria CEO Jim Alkove on Cybersecurity Oversight and Board Communication

Cybersecurity oversight works best when a board can connect technical exposure to business consequences—and when security leaders can show how the company decided to address each risk. Jim Alkove, Oleria’s co-founder and CEO, argues that this shared understanding is still missing in many boardrooms. The gap can leave directors struggling to assess security plans while CISOs find it difficult to win support for the resources those plans require.

Alkove has nearly 30 years of security experience. He previously served as Salesforce’s Chief Trust Officer, spent more than 16 years at Microsoft in roles including Xbox Chief Security Officer and corporate vice president for enterprise and security in the Windows and Devices Group, and held security, privacy and engineering leadership roles at Google Nest. He now advises startups including Aembit, SafeBase and Snyk, and holds 50 U.S. patents.

Turn technical exposure into business risk

One source of friction, Alkove says, is that CISOs and directors often discuss cybersecurity at different levels. Security teams may focus on specific systems, vulnerabilities and controls. Board members, who usually work from a broader business view, need to understand how those details affect the company’s priorities and exposure.

That difference makes translation part of the CISO’s job. A useful board discussion can’t stay at a distant, high-level view, Alkove says; directors need enough detail to make sound choices. But technical descriptions alone rarely give them that context. Security leaders should explain what a risk could mean for operations, customers, sales or finances, and how a proposed action would change the exposure.

Alkove’s advice is to give technical risks a business frame: connect security outcomes to business outcomes in terms directors can assess, including dollars and cents.

Boards don’t need every member to become a security specialist. They do need a working grasp of cybersecurity so directors can question plans, understand trade-offs and oversee work in relation to the company’s broader risk management. Alkove sees two routes to that baseline: bring more technical experience into the boardroom and keep educating existing members.

The need is amplified by the state of company technology. As organizations expand their systems, they can accumulate technology debt, including vulnerabilities that have remained unaddressed for long periods. At the same time, security incidents and scrutiny of company practices add pressure to make decisions with a clear view of exposure.

Reputation and accountability belong in the discussion

Alkove says some boards still treat cybersecurity as a technical matter, overlooking its potential effects on customer trust and sales. A breach can damage reputation in ways an organization can’t simply hand off to another party or reliably cover through insurance. That makes cyber risk a business concern for the CEO and board, working closely with the CISO and the rest of the leadership team.

Security leaders also face rising expectations around protecting sensitive data, while rules can take effect before companies have had enough time to close every gap. Alkove points to concern among CISOs about personal liability in that environment. His broader point is that responsibility needs to be visible: directors and executives must engage with the risks, and security leaders need a record of what they raised and what the organization decided.

That record should capture the risks identified, the proposed steps to reduce them and the company’s response. Sometimes an organization chooses to accept a risk rather than mitigate it. Alkove says the documentation should make that decision and its context clear, and should also show how the CISO communicated resource needs and potential consequences to the board.

Make the case for security investment

Budget limits and pressure to improve short-term financial results can leave security teams without resources for needed controls. Alkove’s example is multi-factor authentication (MFA): despite its role in reducing the risk of account compromise, some organizations still don’t enforce strong MFA across all accounts.

He points to security incidents involving single-factor authentication, including the Midnight Blizzard incident, as a reminder of the stakes. At Salesforce, Alkove made MFA mandatory for all customers; he continues to argue that software companies should adopt the practice. For him, requiring MFA is a basic protective measure, comparable to locking a home’s doors.

The example also illustrates a wider governance problem. A control may be familiar to security practitioners, yet still compete with other spending priorities unless leaders explain the exposure it addresses and the likely business impact of leaving it in place. A CISO’s recommendation becomes easier to act on when it links evidence, risk and a concrete request.

Build relationships before asking for support

Alkove recommends that CISOs treat communication and relationship-building as ongoing work. Security leaders should identify the people who shape or support their program, learn what matters to each stakeholder and adapt how they explain the same risks. That preparation can make a difficult request more relevant to the people weighing it.

He also favors a risk-based approach that connects security outcomes to business outcomes. A strong presentation combines data with a clear account of what could happen, how the proposed action changes the risk and what resources are needed. The goal is to make risks tangible and recommendations actionable, rather than asking directors to accept technical assertions without enough context to judge them.

Regular contact matters after a decision, too. CISOs should keep directors informed about current and emerging risks, while company leaders should speak openly about security’s place in the organization. Alkove sees that continuing dialogue as part of building a culture where security is treated as a shared priority.

Boards face a more complex security estate

Alkove expects boards to take a stronger role as threats grow more sophisticated. That means recruiting members with security expertise, increasing technical representation and providing ongoing education for directors without that background. The aim is for board members to understand enough about security and governance to oversee the issue as a business risk.

The systems companies must protect are also becoming harder to track. Alkove points to the growth of artificial intelligence and software-as-a-service applications as factors expanding the technology estate—the systems and data an organization needs to secure. More systems and data can make access harder to manage, while a changing set of threats adds pressure to existing security processes.

Identity security is Oleria’s focus in response to that challenge. Alkove co-founded the company to rethink identity security, which he describes as a major unresolved industry problem. Oleria says it is developing an adaptive, autonomous approach intended to help organizations manage access as their systems and needs change.

The company contrasts that direction with older identity and access management systems, which it says depend on manual, costly and time-consuming workflows. Oleria’s stated aim is to give security teams one cloud-based place to manage access adaptively and autonomously. The interview doesn’t provide performance figures or deployment details for the product, so the claims describe its intended approach rather than demonstrated results.

For boards and CISOs, the practical takeaway is clearer than any single tool choice: security decisions need shared language, explicit ownership and a record of the trade-offs. Technical expertise in the room helps, but sustained communication is what lets directors connect protection plans to the business risks they are meant to address.

Jim Alkove’s professional profile | Oleria