Communicating Cybersecurity Risk

Conducted for ADZCUT, my master’s dissertation explored how cybersecurity communication can support executive understanding and informed decisions. Five themes address communication, regulation and accountability, alongside implications for the design of risk reporting.

Individual master´s project - 12 interviews - Reflexive thematic analysis

The Challenge

Technical cybersecurity reporting can be difficult to translate into organisational priorities and decisions. My study examined this challenge in the context of the new Swedish Cybersecurity Act.

My Approach

I conducted 12 interviews with cybersecurity professionals and executives, using two dashboards as discussion prompts. I analysed the material through reflexive thematic analysis.

Key Findings

Reporting needs to connect risks to organisational consequences, establish priorities and clarify required decisions. However, making risks understandable does not automatically give executives the means to act.

Interviews

Visual Prompts

Real feedback shaped real decisions. I listened more than I explained.

Link to webpage

Developing themes

I explored patterns across the codes and developed candidate themes, reviewing them against the interview material for coherence and distinctiveness.

Making Sense of the Data

I used reflexive thematic analysis to develop five themes through an iterative process of interpretation and refinement.

Refining themes

Writing the findings helped me clarify each theme’s central organising concept, prompting further interpretation and repeated returns to the data.

Initial coding

Each participant was assigned a distinct colour, allowing me to track their contributions throughout the analysis.

From Research to Recommendations

I translated the findings into two key insights and six design implications.

A spectrum of needs

Executives varied in the level of detail, explanation and support they needed. Reporting should accommodate these differences.

Participants’ needs ranged from support with interpretation to greater depth and context, with no clear pattern by sector or role.

Positions are illustrative rather than measured scores.