Four conversations that make the risk education you provide more effective.
Done correctly, the “Find. Fix. Verify. Repeat.” process means security assessment reports get shorter over time. A patch is applied, cached passwords are cleared out of a browser, or MFA gets enforced, and those findings fall off the next report. But even though an organization’s risk has shifted, it hasn’t gone away, and neither has the person whose decisions will continue to shape how that risk evolves in the coming months and years.
Some of the most valuable parts of a risk conversation never show up as a report finding. No single scan can fully capture the story of what’s gotten better since last time, or who’s responsible for stepping in when something goes wrong, or which of this week’s news headlines matter to a particular organization. And it can’t tell you what the person delivering the readout learned in the last ten environments they looked at.
As security advisors, it’s our job to provide effective education and actionable recommendations that lead to informed decisions, no matter what the individual findings on a report look like.
Here are four conversations that help risk education land regardless of how many pages the report ends up being: what improved since the last report, incident response readiness, how current threats affect the environment, and the lessons other environments teach.
Start with what got better
Report readout meetings tend to be dominated by discussions of what’s still open. That makes sense, because that’s where the risk is. But the people who own the risk made decisions since the last report. They approved budget, and they oversaw remediation work that took time and may have temporarily impacted productivity. If nobody mentions that any of it worked, the readout starts to feel like a report card where only the failing grades get read out loud.
A report shows what’s open today and rarely points out what closed. Put the last report next to this one and the wins are easy to find. Maybe the MFA gaps are gone, or the endpoint tool that used to be on most machines is now on all of them.
So say it, and say it first: “Before we get into what’s still open, here’s what you fixed since last time.” People who hear that their decisions are working are more willing to listen to what comes next. For someone in leadership, seeing an investment pay off is what earns the next conversation and leads to the next decision.
Then, look forward. You know where the biggest remaining risk sits. Lay out what you’d tackle next and why, then ask: “What would make this hard to get done here?” Maybe it collides with their busiest quarter, or the people most affected by the change are going to push back. Their answer gives them a real stake in the plan. It also surfaces obstacles you’d otherwise discover halfway through the rollout.
Pressure-test incident response readiness
Almost everything on an assessment report is about prevention. Incident readiness exists for the day something gets through anyway, but a scan sees very little of it. A tool can confirm that an endpoint has protection. It can’t tell you whether anyone knows what to do when that protection fires at 9 PM on a Friday.
Readiness is also where outcomes get decided. At-Bay’s 2026 InsurSec Report found that businesses reporting a financial fraud within three days recovered at least some of their funds 70% of the time. That result comes down to speed: someone recognized what was happening and knew who to call.
Coalition’s 2026 Cyber Claims Report found a record 86% of businesses refused to pay ransom demands in 2025, which the report attributes to usable backups and incident response plans.
So skip “Do you have an incident response plan?” That question almost always gets a yes, because a document exists somewhere. Ask something specific instead: “If an email asks to change wire details tomorrow, who gets the call, and how fast?”
Then keep going. Does the person who’d get that call know they’re the one? Is there a phone number for the bank that didn’t come from the email? Would anyone in the room know what to do in the first hour? Every “I’m not sure” is a gap you can close now, while closing it is still cheap.
The insurance conversation belongs here too. When a claim comes in, the carrier looks at the application, which describes the environment as it was when someone signed it. Since then, MFA may have been switched off for a few users who complained, or backups may no longer run the way the form says they do. A mismatch like that can make a bad day much more expensive. Ask whether the environment still matches what’s on the application. Frame it as protecting money they’ve already spent, and leave interpreting the policy to their broker.
Connect threat intelligence to the environment
Current threat intel never shows up as a finding, yet it’s one of the best ways to keep a risk conversation going, even between reports. It’s also easy to get wrong.
The common version is forwarding the headline. A big vulnerability makes the news, someone sends the article with “FYI, keep an eye on this,” and the person reading it ends up more worried with nothing specific to do. That’s anxiety with a link.
The better version answers the question the reader actually has, which is whether this affects them. Speed matters here. VulnCheck’s 2026 State of Exploitation report found that almost three in ten vulnerabilities newly exploited in 2025 were hit on or before the day they were disclosed. Waiting for the next scheduled assessment to bring it up isn’t an option.
You already have what you need to answer that question, because the last report tells you what’s in the environment. If the headline is an exploited flaw in a firewall or VPN, you know whether they run that device and whether it faces the internet. If it’s a wave of business email compromise, you know whether there’s a verified process for payment changes. CISA’s free Known Exploited Vulnerabilities catalog is a good place to check whether a vulnerability is being used in the wild.
Keep the update short, and use the same shape every time:
- What happened, in one sentence.
- What the attack targets.
- Whether that’s in their environment, and where it showed up on their report.
- What you’d do about it.
It takes a minute to read, it shows you’re paying attention between reports, and it hands the reader a decision instead of a worry. Sometimes line three is “you don’t run this,” and that’s useful too, because it answers the question before anyone has to ask it.
Every environment is a story
Every environment you look at teaches you something. It might be an odd configuration, or a fix that turned out to be easier than anyone expected. The mistake is keeping that experience to yourself.
So build a habit. After every readout, write down one story: what was found, why it mattered, what they did about it, and what changed. Strip out anything that identifies the organization, because the story is about the pattern instead of the company. If you’re not sure where to start, think about the finding that surprised everyone, or the one that kept coming back.
Here’s what that might look like:
In another environment we assessed, we found an admin account belonging to the company’s previous IT provider. The contract had ended two years earlier, but the account was still active with full administrative rights and no MFA. Nobody had thought about it because nobody remembered it was there. They disabled it that afternoon. Then they went through every vendor that ever had access and added an offboarding step to their vendor contracts. The next assessment didn’t turn up a single stale account.
Then turn it back to the room: “Has anyone had access to your systems who doesn’t work with you anymore? What happened to the accounts they used?” A question like that usually gets people telling their own stories, and those often end up being the most useful part of the readout.
You don’t have to collect these alone. When practitioners share what they ran into last week, whether in a peer group or on a community call, everyone listening walks away with another example. Your experience is your threat intel.
Building on every readout
When progress is being made, assessment reports get shorter over time. That’s a good outcome, and it doesn’t leave you with less to say. Everything above works whether the report runs ten pages or two, and none of it relies on particular findings being included.
If you’re the one being presented with findings, these are fair things to ask for: what improved since last time and what’s planned next. The answers tell you whether the work you’re paying for is having an impact and help put the “verify” in your “Find. Fix. Verify. Repeat.” process.
Regardless of the seat you occupy, what lasts is a shared understanding of where the business stands and what to do about it, built one readout at a time.
Most findings are supposed to be temporary. The conversation around them shouldn’t be.
P.S. - Want a head start on the threat updates and stories above? Galactic’s Threat Thursday articles cover current threats and what they mean for impacted organizations, and each one is easy to turn into a four-line update or a story for your next readout.
