How would you explain a security risk to a non-technical executive so they can make a funding decision?

What the interviewer is looking for

• This question tests risk communication. Translates technical risk into business impact and likelihood so non-technical leaders can decide.
• What to bring out: Uses business impact, likelihood, realistic scenarios and cost comparisons, avoids jargon and fear, and offers options.
• Expect a follow-up like: How do you handle it when they choose the cheaper, riskier option?

Another way it may be asked: Your chief executive asks whether a security project is worth the money. How do you explain the risk?

A structure to follow: STAR, with the weight on Action and Result

1. Step 1

   Situation

   One or two sentences: where, when and what was at stake. Pick a real example you were close to.

2. Step 2

   Task

   What you personally were responsible for. Say "I", not only "we", so the risk communication you showed is visible.

3. Step 3

   Action

   The two or three things you did and why you chose them over the alternatives. This should be about half your answer.

4. Step 4

   Result

   What changed, in your own measure of it, and what you would do differently. Only use numbers you can stand behind.

This is guidance on shape, not a script. Use your own real experience and facts; never invent details to fill a gap. See the STAR guide and answer frameworks.

Common slips

• Describing what the team did without saying what you did.
• Choosing an example with no clear outcome, or one you cannot answer detailed questions about.
• Ending on the action and skipping the result and what you learned.

How to practise it

Write two bullet points for each STAR letter, then say the answer aloud in about two minutes.

Related questions

• What is SQL injection, how does it happen, and how would you prevent it in a web application?
• Why is multi-factor authentication important, and which kinds of second factor are stronger than others?
• You notice a user account logging in from two countries an hour apart. What would you check, and what would you do?
• A scanner reports three thousand vulnerabilities across your systems. How do you decide what to fix first?
• Walk me through how you would threat model a new feature that lets users upload files to share with others.

Browse all questions