Just to be clear, this isn't about presentation skills. There's a separate piece in this pillar that covers how to structure data for different audiences. It talks about what leadership needs versus what a technical team needs, and shows you how to avoid the common mistakes. This is about something that sits upstream of all of that.
It's about what you lead with and why. Because even the most well-structured, clearly presented set of data can land with a polite nod and nothing else if it doesn't connect to what the people in the room are already worried about.
This is something that has caught me out before and I don’t think I’m the only one.
You've got good data. You've been tracking the right things, trending them over time, building a picture of where the programme is and where it's going. And then you walk into a room with senior leadership, present it clearly, and it lands with a polite nod and not much else.
The data wasn't the problem. The translation was.
Senior leaders don't think in awareness metrics
Senior leaders will think in a different language to us. They will think in the language of risk. They are concerned about things like exposure, the likelihood of something happening, the impact if or when it does and the cost to get out the other side. When you present a culture survey score or a phishing click rate, what they hear is a number that belongs to someone else's world. You have to do the work of connecting it to theirs, because they won't.
The question senior leaders will always be asking, even when they don't say it out loud, is: should I be worried about this? And more specifically: does this connect to something I'm already worried about? That second question is the one most awareness presentations miss entirely.
Start with what's on their radar
Think about what senior leaders are focused on right now. It could be deepfake-enabled fraud or business email compromise. It could be credential theft or AI-generated phishing that bypasses the instincts employees have built up over years of training. These aren't abstract threats by any means. They are in the news, in board risk registers, and in conversations with insurers and regulators. Your job is to find the intersection between what your data shows and what's already on their radar.
If social engineering is the hot topic, don't show them your overall culture survey score. Show them whether your workforce would recognise and report a vishing or voice impersonation attempt and show them the reporting rate in the populations most likely to be targeted. Then show them the trend in susceptibility among your finance team over the last three quarters. That's exactly the same data, just looked at through a different lens, and it answers the question they're actually asking.
How you present it matters as much as what you present
A spreadsheet full of numbers isn't a presentation. A one-page summary with a clear headline, a trend line, and two or three data points that tell a story is. The format signals something about how seriously you've thought about their time and their ability to absorb what you're showing them.
And here's something that works really well in practice. Go in prepared with more than you need, then ask them what they want to see. Not as a sign that you haven't prepared, but as a deliberate move. It turns a presentation into a conversation, it tells them you've got depth, and it means the thirty minutes you have is spent on the things that matter to them rather than the things you decided mattered before you walked in. Most people don't do this because it feels risky where as it’s actually the opposite.
The translation layer
This isn't about dumbing things down but more about relevance, which is actually something an effective awareness professional is doing all of the time with their content. A risk director doesn't need less information. They need information that maps to how they think about their job. They will be interested in risk exposure, the likelihood of a harmful event occurring, the potential cost if it materialises, what's being done to reduce it and whether it's working.
Your awareness metrics can answer all of those questions. You reporting rate is a leading indicator of whether human-factor risk is decreasing. Susceptibility trends in high-risk populations speak directly to likelihood. Culture survey movement over time tells you whether the underlying conditions that make people vulnerable are shifting. None of that requires new data. It just requires a different frame.
One practical move before any senior presentation
Look at what's on your organisation's risk register and what's been in the news in the last quarter. Find two or three points where your data intersects with something they're already tracking. Lead with those and use the rest as depth if they want it. That preparation takes an hour and the difference it makes to how the conversation goes is significant.
