It’s 3 a.m., sometime in 2007, and I’m nineteen years old with a headset on, staring at a wall of monitors in a MAMRAM server room that smells like hot dust and instant coffee. Something is blinking that shouldn’t be blinking. My commanding officer, half-asleep on a cot behind me, says exactly one sentence before rolling back over: “Tell me if it’s real, not what it looks like.”
Twenty years later I’m in a glass-walled boardroom in Tel Aviv, in front of a bank’s executive committee, and a CFO asks me almost the same question with better tailoring: “Is this actually a risk, or is it just IT being dramatic again?”
Same question. Different uniform. That’s the whole story of this episode.
The Night I Learned to Read Ghosts
MAMRAM doesn’t teach you tools first. It teaches you doubt first. In a room full of logs, most of what glows on the screen is noise — a misconfigured cron job, a flaky sensor, a false positive dressed up as Armageddon. The actual incident, the one that matters, is usually quiet. It doesn’t scream. It waits.
I spent years there, and later at HOSHEN and jumping out of planes with the Paratroopers Brigade before circling back into the technical world, learning to tell the difference between a ghost in the servers and a fire in the building. That skill — separating signal from noise under time pressure, with incomplete information, while someone senior is waiting for a one-sentence answer — turned out to be the only transferable skill that mattered. Not the specific SIEM. Not the specific protocol. The judgment.
Twenty Years, Same Alarm, Different Language
After the army I built ISO 27001 from scratch at Nation-E — no framework, no legacy, just me, a whiteboard, and a founder asking “why do we need this to sell energy hardware in Europe?” I ran CISO-as-a-Service at Comsec across Horizon 2020 research consortiums, translating EU compliance jargon into things engineers could actually build. I led cybersecurity for eighteen U.S. universities at ThriveDX, where the “attack surface” wasn’t a data center — it was forty thousand eighteen-year-olds clicking on everything. And now, as CTO of Cyber Risk Advisory at BDO, I sit across from banks and enterprises running NIST and ISO assessments where the stakes are measured in nine-figure numbers and regulator attention.
Different industries. Different budgets. Completely different attackers. And yet, every single time, the actual failure point was the same one from that server room in 2007: someone saw the signal and didn’t know how — or didn’t dare — to say what it meant in the language of the room they were standing in.
The One Lesson: Translation Is the Job
Here’s the lesson, stated plainly, because I’ve learned the hard way that burying the point is its own kind of failure: security doesn’t fail at the firewall. It fails at the sentence nobody said to the person who could have acted on it.
A SOC analyst who spots lateral movement but writes “anomalous auth pattern, ticket #4471” instead of “someone is currently inside our finance systems” has technically done their job and completely failed the mission. A CISO who presents a 40-slide deck of CVSS scores to a board that just wants to know “can this stop us from closing the Q3 books” has lost the room before slide three. I’ve watched both happen. I’ve been guilty of both, early in my career, when I still thought precision meant more jargon rather than less.
What It Costs When You Skip the Translation
I’ve sat in enough post-incident reviews to know the pattern by heart. A European manufacturer I assessed had detected unusual outbound traffic eleven days before the ransomware detonated. Eleven days. The alert existed. It sat in a queue, correctly categorized, technically accurate, and utterly useless — because nobody had built the bridge between “unusual outbound traffic” and “this is how much it will cost the CEO if this becomes real.” When it detonated, the number was north of four million euros in recovery, downtime, and client churn combined. Not because the detection failed. Because the translation did.
Compare that to a bank we worked with that ran a proper Business Impact Analysis before anything went wrong — the chaos-to-BIA-to-roadmap sequence I’ve written about before. When a genuine incident hit eighteen months later, the incident commander didn’t have to explain from scratch why the payments system took priority over the marketing CMS. That conversation had already happened, calmly, months earlier, in a room with coffee instead of adrenaline. The recovery took hours instead of days, and — this is the part boards actually remember — nobody had to improvise a story for the regulator at 2 a.m.
The Architecture of Translation
This isn’t a soft skill you either have or don’t. It’s a discipline you build, the same way you’d build Formula 1 brakes — not as an afterthought bolted on, but engineered in from the start so the car can go faster, not just stop harder. Practically, it looks like this:
- Every technical finding gets a business sentence attached before it leaves the SOC — not “SQLi vulnerability, CVSS 9.1” but “an attacker could pull our full customer database, and we’re contractually required to disclose that within 72 hours.”
- Risk registers are written for the CFO, not the auditor. If a line item can’t be read aloud in a budget meeting and understood, it’s not finished yet.
- BIA before crisis, always. Decide what “critical” means on a boring Tuesday, not during an incident, when everything suddenly feels critical because panic is a terrible prioritization engine.
An Invitation, Not a Command
Away from servers and boardrooms, I teach sensual bachata at my studio, and there’s a principle there that I now realize I’d been practicing professionally for two decades before I ever set foot on a dance floor: leading is an invitation, not a command. You don’t force a follow into a turn; you create the clarity and the space where the right move becomes obvious. Boards are the same. My job was never to command a CFO into caring about zero trust architecture. It was to build the frame — the number, the scenario, the plain sentence — where the right decision became the obvious one.
Takeaways
- Every alert needs a translated sentence attached at the moment it’s raised — technical accuracy without business context is a ticket nobody will act on until it’s too late.
- Run your Business Impact Analysis before the crisis. Decisions made calmly on a Tuesday are cheaper than decisions improvised during an incident.
- Write your risk register so a CFO could read it aloud and understand it — if it needs a glossary, it’s not a business document yet, it’s still an engineering note.
- Judgment — separating the real fire from the ghost on the screen — is the one skill that transfers across every uniform you’ll ever wear, military or corporate.
Back to the Server Room
That blinking light at 3 a.m. in 2007 turned out to be nothing — a misconfigured replication job, not an intrusion. But the habit it built in me wasn’t nothing. Twenty years, three countries, five industries, and one dance studio later, I still ask myself the same question my commanding officer asked from his cot: is it real, or does it just look like it? And then, immediately after — if it’s real, who needs to hear it, and in what language will they actually understand it? Everything else in this career has been details.
I write From the CISO’s Diary from 20 years across BDO, ThriveDX, the IDF and my own ventures. Let’s connect: Omri Sagron on LinkedIn.
