How to Give a Good Talk

A Guide for Security Engineers

Michael Hicks · Penn CIS · CIS 7000 · Spring 2026

Roadmap

  1. Foundations — Why giving a good talk matters
  2. Structure — Designing your talk
  3. Slides — Your visual aid, not your script
  4. Delivery — Bringing it to life
  5. Security-Specific — Special considerations
  6. Process — Putting the talk together

Running example: A security talk about the 2013 Target data breach

Part 1

Foundations: Why This Matters

A talk is your opportunity to influence behavior

Foundations Structure Slides Delivery Security Process

Every Talk Has a Purpose

Your purpose is not to inform — it's to change behavior. How?

"If it's original, you will have to ram it down their throats." — Howard Aiken

"Original" = anything that challenges the status quo.
A new priority. A change in practice. A different way of thinking.
The more it departs from what people already believe, the harder you must work.

A great talk is how you do the ramming.

The Stakes Are High

Security is rarely the primary motivation of your audience.

They're thinking about features, deadlines, revenue, headcount...

Your talk may be your best chance to change that.

Competing priorities — security buried under other work

Our Running Example Example

The scenario: It's January 2014. The Target data breach just made headlines.

You are: A Security Architect at a mid-size retail company.

Your audience: CTO, VP Engineering, VP Finance, 3 Dev Team Leads.

Your task: Get budget approved for network segmentation and vendor access controls.

Target data breach news coverage

Know Your Goal

"If the audience remembers only one thing from your talk, what should it be?" — Simon Peyton Jones
Simon Peyton Jones giving a talk

Common Goals for Security Talks

  • Getting budget approved for a security initiative
  • Changing development practices or policies
  • Building awareness of a specific threat
  • Gaining support for risk mitigation measures

State your goal explicitly — even to yourself — before creating a single slide.

Our Goal Example

"Get the CTO and VP Finance to approve $2M for network segmentation and vendor access controls before Q2."

Not "educate leadership about the Target breach."
Not "raise awareness about network security."
A specific action by specific people by a specific date.

Know Your Audience

A talk aimed at everyone reaches no one.

Customize ruthlessly.

A classroom full of people — the audience you're trying to reach
People not paying attention during a presentation

What Technical Leaders Want

Specifics

Evidence

Feasibility

Development team in a sprint planning meeting

What Management Leaders Want

Business Impact

Dollar sign — business impact

Cost-Benefit

Balance scale — cost-benefit analysis

Options

Fork in the road — options

Confidence

Handshake — confidence and trust

Example: Same Topic, Different Audiences Example

VP Engineering wants to hear:

"Target's network was flat — attackers pivoted from HVAC vendor to POS systems. Our network has the same architecture. Here's a segmentation plan with a 6-month rollout."

VP Finance wants to hear:

"Target's breach cost $300M+. We process $50M in card transactions. A $2M investment in network segmentation reduces our exposure by an estimated 80%."

Same breach. Same recommendation. Different framing.

The Mixed-Audience Challenge

Start with business impact (for management)

Layer in technical detail (for technical leads)

Have deep-dive backup ready (for experts who ask)

Use analogies for the non-technical: "Think of it like a lock on a door..."

Translate jargon in real-time: "The firewall — think of it as a security guard checking IDs..."

Example: Before & After Example

A visual the whole room can understand

Before: Flat network

All on one network HVAC Vendor Email Server Corp Apps POS Systems Database Card Data Vendor → POS → Card Data

After: Segmented network

VENDOR ZONE HVAC Vendor BLOCKED CORPORATE ZONE Email Corp Apps PAYMENT ZONE (isolated) POS Systems Card Data No lateral movement possible

Part 2

Structure: Designing Your Talk

Lead with the punchline, not the setup

Foundations Structure Slides Delivery Security Process

A Talk Is Not a Mystery Story

Anti-pattern

"First let me explain the attack...
then our vulnerabilities...
then three solutions...
then my recommendation."

Half the audience checks out before the punchline.

Better

"We need to implement X
to prevent Y.
Here's why, and
here's the evidence."

Lead with the claim. Then support it.

Example: Don't Bury the Lede Example

Mystery story version

"Let me walk you through how Target was breached. First, Fazio Mechanical, an HVAC vendor, received a phishing email. Then the attackers used those credentials to access Target's network. The network was flat, so they could reach the POS systems. They installed RAM-scraping malware. 40 million cards were stolen. Now, our network is also flat..."

20 minutes in and the CFO still doesn't know what you're asking for.

Claim-first version

"We need $2M for network segmentation to prevent a Target-style breach. Target lost $300M because their network was flat — attackers moved freely from an HVAC vendor to payment systems. Our network has the same vulnerability. Here's the plan, and here's the evidence it works."

30 seconds in, everyone knows what you want and why.

The Overall Structure

Give them a roadmap, then take them on the journey

  1. Opening Hook (1–2 min): Why should they care right now?
  2. Problem & Solution Teaser (2–3 min): What's at stake & your recommendation
  3. Problem in Depth (5–8 min): Evidence the problem is real & urgent
  4. Solution in Depth (10–15 min): How it works, with examples
  5. Evidence / Results (3–5 min): Data, case studies, demos
  6. Call to Action & Summary (2–3 min): What you want them to do

V-Shaped Complexity

From Ranjit Jhala

High Level Accessible to everyone Technical Depth High Level Summary & implications People who "tuned out" can rejoin here

Onion, Not Clew

From Herman Haverkort

Clew (Linear)

A B C D Conclusion

Miss one step → you're lost

Onion (Layered)

Core
Message

Each layer adds depth; core always visible

Common pattern: CGI

From Derek Dreyer

Context
Set the stage
(1–2 min)
Gap
The problem & why
existing approaches fail
(2–4 min)
Innovation
Your solution
& how it helps
(the rest)
Derek Dreyer giving a talk

CGI for Target Talk Example

Context
"Target was breached in December 2013. 40 million cards stolen. $300M+ in costs. CEO and CIO resigned."
Gap
"Our network has the same flat architecture. Vendor access is uncontrolled. We have no segmentation between corporate and payment systems."
Innovation
"Network segmentation + vendor access controls. $2M investment. 6-month rollout. Reduces exposure by ~80%."

What to Include — and Cut

Ruthlessly prune anything that doesn't serve your goal.

  • For each piece of content: "Does this serve my goal? Does my audience need this?"
  • If tangential but important: "For details, see the appendix/report"
  • Have backup slides for Q&A — content you cut but might need

For Security Specifically

  • Lead with business impact, not technical details
  • Use data when you have it; be honest about uncertainty when you don't
  • Present stackable options: "We could do A, or A+B, or A+B+C"
  • Reframe: "This investment protects $X million in revenue"
    not "We might get hacked"

Part 3

Slides: Your Visual Aid, Not Your Script

If your slides make sense without you, they have too much text

Foundations Structure Slides Delivery Security Process

Slides Support, Not Replace

If you can read your slides verbatim, they have too much text.

Pictures Over Text

Express ideas visually whenever possible.

The "Thrice Told" principle:

Written
on the slide
+
Uttered
by you
+
Illustrated
visually

Key ideas should appear in all three channels.

Bad Slide Example

Target Data Breach: Background and Analysis

  • In December 2013, Target Corporation disclosed a major security breach
  • Attackers gained access through Fazio Mechanical Services, a third-party HVAC vendor, using stolen credentials obtained via a phishing email
  • The attackers exploited Target's flat network architecture to move laterally from the vendor portal to payment card processing systems
  • RAM-scraping malware was installed on POS terminals across 1,797 stores
  • Approximately 40 million credit and debit card numbers were compromised, along with 70 million customer records containing personal information
  • Total estimated cost to Target: $300M+ including settlements, fines, remediation, and lost business
  • Target's CEO Gregg Steinhafel and CIO Beth Jacob both resigned
  • FireEye security tools detected the breach but alerts were ignored

Every word is accurate. Nobody will read it.

Good Slide Example

The chain of attack

Phishing
email
Vendor
credentials
Corporate
network
Flat
network
POS
malware
40M cards
$300M+

You tell the story. The diagram anchors their understanding.

Visual Tools for Security Talks

Architecture diagrams

Attack flow visualizations

Dashboard screenshots

Before/after comparisons

Risk heat maps

Timeline diagrams

Clean security architecture diagram

Sometimes Text Is Okay

  • Slide titles — always
  • Key statistics or quotes — occasionally
  • Brief labels on diagrams
  • One-sentence summary of a key point
  • (Unfortunately:) When you don't have time to do better!

But never too many bullet-heavy slides in a row.

Slide Titles Example

The title is often the most important text on the slide.

Generic label

"Security Incident Review"

Key point as title

"We're Vulnerable to the Same Attack That Cost Target $300M"

One Point, One Slide

Each slide should make exactly one point.

If it has two points, make two slides.

Too Many Points Example

FireEye dashboard with alerts

5 malware variants flagged

Bangalore
saw alerts
Minneapolis
escalated to
No action
Empty security operations center
Switch in off position

Auto-delete was off

Three points crammed into one slide. Everything is too small to read.

Point 1: The Tools Worked Example

FireEye security dashboard with red alert banners

Five malware variants flagged. Server addresses identified.

Point 2: The People Didn't Example

Bangalore
saw alerts
Minneapolis
escalated to
No action
"not warranted"
Empty security operations center

Point 3: Auto-Delete Was Off Example

Power switch in the off position

FireEye could have automatically deleted the malware.

That feature was turned off.

Flow and Coherence

Slides should flow like sentences in a paragraph. Narrative.

Within slides

Between slides

Transitions

Animation: Principles

  • Use builds to reveal information incrementally
    • Effective: revealing parts of a diagram step by step
  • Animation should guide attention, not decorate

Formatting Essentials

Font size: Min 28–30pt body.
Shewchuk recommends 38pt text, 42–50pt titles

Font type: Sans-serif only
(Arial, Calibri, Helvetica)

Colors: Dark on light OR light on dark
Pick one. High contrast.

No clutter: Remove logos, decorations, unnecessary graphics

Match backgrounds: If including a diagram, ensure its background matches your slide

The Last Slide Matters

Never: just "Thank You!" or "Questions?"

Instead: Summary of key points + your call to action

This slide stays up during Q&A — make it work for you.

Include pointers to more information if relevant.

Part 4

Delivery: Bringing It to Life

No substitute for practice

Foundations Structure Slides Delivery Security Process
"Your most potent weapon is your enthusiasm." — Simon Peyton Jones

If you don't seem excited,
why should they be?

Practice Is Non-Negotiable

  • Practice out loud — not just reading in your head
  • Memorize the first few slides — then roll into natural delivery
  • Time yourself — and cut ruthlessly if over
Someone practicing a presentation

Practice Techniques

  • Give at least one practice talk to real people
  • Video yourself to catch tics and awkward moments
  • For high-stakes talks: multiple practice runs to different audiences
"Write your slides the night before — freshness matters." — Simon Peyton Jones

Delivery Do's and Don'ts

Don't

Speaker turned away or reading from slides

Read from your slides
Turn your back to the audience
Pace nervously
Apologize for your preparation

Do

Speaker facing the audience with open gestures

Face the audience, not the screen
Make eye contact
Move purposefully
Use hands for emphasis

Managing Nerves

The "jelly effect" — weak legs, tight chest — is universal.
It doesn't mean you're not ready.

Deep breathing before you start

Move around and use large gestures — physical activity releases tension

Verbal Signposts

Help your audience track the narrative.

"So we've covered the threat landscape. Now let's talk about solutions."

"Here's the most important point..."

"If you remember nothing else from today..."

"So the key takeaway is X. Now let's look at Y."

Pause Between Ideas

Silence is powerful.

Speaker pausing deliberately

Vary your pace — slow down for important points.

Handling Questions

Questions are opportunities, not threats.

Repeat the question back

"I don't know" is always okay

Have backup slides ready

Don't get defensive

Audience asking questions

Encouraging Questions

  • Pause at natural breaks and invite questions
  • Acknowledge that "basic" questions are welcome
  • Create safe spaces:
    "This is complex — what questions can I clarify?"
Encouraging questions

Part 5

Special Considerations for Security Engineers

Security enables the business — it doesn't block it

Foundations Structure Slides Delivery Security Process
FUD definition

Frame as Opportunity, Not FUD

Fear

"We might get hacked like Target."
"Bad things could happen."
"We're at risk."

Scary red alert conveying FUD

Opportunity

"A $2M investment protects our $50M in card transactions."
"This reduces our exposure by ~80%."
"This puts us ahead of PCI-DSS 3.0 requirements."

Shield protecting revenue — opportunity

Speak the Language of Business

Risk = Likelihood × Harm

Benefit = Risk Reduced − Costs

Use data when possible — but be honest about uncertainty

"We estimate..." not "This will..."

Example: The Business Case Example

Cost of a breach
$50M+
Based on Target's $300M at 6x our scale
Cost of prevention
$2M
Network segmentation + vendor controls
Risk reduction
~80%
Estimated exposure reduction

This is a slide a CFO can act on.

Security Communication Principles

  • Never let a crisis go to waste: When incidents happen, use them to advocate for improvements
  • There is no perfect security: Present risk reduction, not elimination. Be honest about trade-offs.
  • Right things, easy things: Are we protecting the right assets? Are we making secure behavior easy?

Building Trust

You're building trust, not winning arguments.

  • Present trade-offs fairly, even when you have a clear recommendation
  • Be transparent about limitations and uncertainties
  • Trust your audience's judgment — give options, let them choose
Building trust

Part 6

The Process: Putting The Talk Together

Figure out what to say before you open your slide editor

Foundations Structure Slides Delivery Security Process
"Figure out what you are going to say first, in increasing detail, then set out to make the slides." — Michael Hicks

The Six-Step Process

  1. Step 1: Write your goal in one sentence
  2. Step 2: List your key landmarks/points (outline)
  3. Step 3: For each point, decide how to support it (example, data, diagram)
  4. Step 4: Sketch placeholder slides with titles and notes
  5. Step 5: Now open your slide editor and build the real slides
  6. Step 6: Review — can you cut 20%? You probably should.

Iterative Refinement

Start with bullet lists, then ask:
"Can I say this with less text? Can I use an illustration?"

This naturally leads to the "thrice told" principle
and reduces narrative-only text.

Idea: design the last slide of each section first,
then work backward.

Hicks: How to Write a Conference Talk · Jhala: An Opinionated Talk on Preparing Good Talks (PDF)

Before You Present: Checklist

  • I can state my one key message in a single sentence
  • I know what behavior change I want from my audience
  • Each slide makes exactly one point
  • My slides have minimal text; ideas are illustrated visually
  • My slide titles emphasize key points, not generic labels
  • I've practiced out loud at least twice
  • I've timed myself and I'm under the time limit
  • My final slide summarizes key points and my call to action
  • I have backup slides for likely questions

Key Takeaways

1. Have a goal
Know the behavior change you want
2. Know your audience
Customize for technical vs. non-technical; lead with business impact
3. Structure for success
Claim first, then evidence; CGI model; onion over clew
4. Slides support, not replace
Minimal text, maximum visuals; one point per slide
5. Deliver with energy
Practice, be enthusiastic, face your audience, use signposts
6. Build trust
Frame security as opportunity; present options; use data honestly

Resources