Bridging Tech & Leadership: Gurps Khaira on Cyber Security, Risk & Results

As digital transformation accelerates, businesses face growing pressure to manage complex technology projects while staying ahead of ever-evolving cyber threats. Gurps Khaira has spent over 15 years at the intersection of change management, cyber risk mitigation, and enterprise strategy—guiding global organisations through major IT and security initiatives with precision and impact.

A senior delivery leader and sought-after cyber security speaker, Gurps is known for turning high-level goals into actionable outcomes. Drawing on his expertise in Agile, Waterfall, and hybrid frameworks, he helps organisations improve operational resilience and influence decision-makers through strong reporting, risk communication and governance structures.

In this exclusive interview with The Champions Speakers Agency, Gurps shares practical insights on project delivery, leadership, and why soft skills are just as critical as technical know-how in today’s cyber security landscape.

Q: In today’s fast-paced corporate environment, which strategic execution frameworks have you seen consistently deliver measurable results?

Gurps Khaira: “It’s action, you know. I’ve delivered quite a lot of different types of projects using different frameworks such as waterfall, agile, and hybrid. And, you know, the crucial thing is action—it’s taking action. 

“It does not matter what framework you use or what tools you use, but if you’re not able to grasp the absolute basics of change management and technology implementation and project management—which are being able to track what the actions are coming from, usually what is a very back-to-back meeting culture, right?

“So, you know, ten people can get in a room for 30 minutes, and if there’s not a project manager tracking those actions—that’s what, 300, so 3,000 minutes, so to speak, lost of that organisation’s time within that half an hour period if I’ve done my maths right. And so, you know, I believe you’ve got to have somebody tracking those actions and then following through with making sure those actions are executed.

“Now, very much in the change management world, you know, a project manager usually is like putting together a really big jigsaw puzzle, right? And you rely on many different stakeholders to help you deliver your implementation or the new technology that’s going to be arriving. 

“And usually, it involves the project manager to actually influence without authority. So you’ll have a lot of different people to coordinate, and you essentially have to get them to do work for you in order to help this implementation of the new technology land.

“So, there is a lot to be said about soft skills as well—not just the technological tools and frameworks that we use, but the personality, the charm, the charisma of that person as well. You know, like, how do you get people to deliver work, even though they’re not directly reporting for you? 

“So I think there is a huge element of people and your personality. And I say that because the tools and the frameworks, I think now, it’s almost driven by the personality of the individual that comes into doing that job.

“So, you know, as a project manager, when I’m hiring project managers, I’m not looking at, you know—I know what tools or technologies and frameworks they can use—but ultimately, I kind of expect them to already have that in their back pocket from their experience. 

“So the tools and frameworks—it’s down to them, like whichever framework they want to use—whether it’s agile, whether it’s waterfall, or hybrid, which at the moment is very, very common for large-scale enterprises.

“Because there isn’t that one-size-fits-all, right? Every organisation is different, and within every organisation, all the teams are different—different personalities. So, it’s very much dependent for me on that project manager’s personality traits. 

“And so, for me, I think provided the person and the personality have some charisma and charm and will be able to work with quite a lot of different people—whether they use the agile methodology, whether they use waterfall framework—it’s down to that person, I believe.

“But the key thing, as I mentioned at the beginning of this answer, was that the project manager has to be able to execute the actions and track them very well. So, it’s all about action-focused delivery.”

Q: Communicating cyber security risks to senior executives can be challenging. How do you ensure business leaders without technical backgrounds feel informed and empowered to make the right decisions?

Gurps Khaira: “For me, it’s about, again, communication and understanding that change management framework. And as I mentioned in the previous answer, it’s about being a bridge between the technical delivery teams and the non-technical senior management audience.

“One of the key skills for me in being that bridge is being able to create documentation and reports. Now, my chosen weapon—which I think is the best thing since sliced bread—is PowerPoint. 

“And I believe in very simple one-pager documents whereby you’re able to get the updates that you need—the status reporting updates from the technical delivery teams—through, let’s say, your daily stand-ups and then be able to articulate and communicate those in a very simple one-pager for the senior management audience, who, as we know, is very, very short on time.

“They need to be able to analyse quite a lot of information very quickly in order to make those decisions. So I believe in being able to understand the delivery—the technical delivery risks being highlighted by the delivery team—and then you as the project manager or programme manager being the person who can then articulate those into pretty pictures that are then mapped back to, let’s say, the business outcomes or the risks associated to those outcomes.

“So, one of the key things in helping to make decisions is that cyber security, very often, is a cost centre, right? We’re not a revenue-generating function of a business. However, we do defend and mitigate those risks of losses and operational downtime as well from attacks or cyber-attacks.

“And so it’s being able to then understand the technical languages that the technical delivery teams—the solution design architects, the technical subject matter experts, the business analysts, the delivery team—are highlighting to you in your daily stand-up. And then perhaps you have either a weekly update or a fortnightly update with your senior-level audience. 

“But all of that is mapped on a one-page document which paints the entire picture—like a very clear status report, let’s say—which shows the senior-level audience what the project scope is, how that’s tracking, what the schedule is looking like, the project plan, how we’re performing against the budget that’s been allocated to the project, even also the team and the resources being allocated—do we have enough people to deliver the latest implementation?

“So you’re tracking all of that. I’ve developed quite a lot of these internal templates that I’d like to think I’ve mastered over the last 15 years or so, which really allow me to report very complicated technical cyber security information into very simple, pretty pictures that allow critical identification of risks. 

“And then, the audiences that need to make the decisions can look at those one-pagers and instantly make those decisions very quickly, within a very short space of time.

“So, to summarise, I think it’s very strong governance and also having very strong reporting templates for those different audiences.”

Q: From your experience, what’s the most effective approach to identifying and managing risk in large-scale business operations?

Gurps Khaira: “Transparency. I think—I have a saying, which is to always deliver bad news fast. That is the absolutely critical thing. It’s great when things are going well, and we want to report good news. But for me, it’s being able to identify those technical delivery risks.

“Again, I mentioned the daily stand-ups that I’ve been sharing for the last 15 years or so and being able to identify those and then communicate those risks instantly. It’s much better to over-communicate bad news than it is to sort of sit on it and not inform your stakeholders of the risks.

“And then those risks are also part of the decision-making process that we spoke about in the previous question. Those risks have to be captured and highlighted very accurately so that the business impact of those risks is understood, which then impacts the decisions that those senior-level stakeholders need to make.

“So always, always deliver bad news fast. Again, it goes back to being able to articulate and track those risks into those very clean, crisp one-pagers that I’ve been creating over the years, which then allows those non-technical leaders to be able to very clearly understand complicated technical delivery risks.

“And there are multiple different types of risks as well, that you, as a project manager—it’s your duty to identify those, right? So, as well as having technical delivery risks, there are risks to the project plan, the schedule, and the milestones. There can also be risks to your resources and the people in your team—maybe somebody who’s a critical sort of the single point of success or single point of failure, whichever way you want to call it—maybe they’re resigning, and a replacement can’t be found.

“So, a massive, perhaps an operating model piece of work that they were assigned to do is now at risk of not being delivered. So there’s resource risks, there’s cost risks—always. Everyone’s always trying to deliver implementations as cheaply and as cost-effectively as possible.

“So again, a programme manager or project manager needs to be able to have a very close eye on the financial forecast as well. There are all these multiple different types of risks that have to be managed and reported upwards.

“And I put all those kinds of risks into project risks. These are things you can mitigate, you can accept and do something about—so you have a bit more control over them. But then there’s something we don’t have any control over, which is market risk. 

“And that is usually—we accept those risks provided they’re articulated. And then, stakeholders and decision-makers are happy to proceed with the implementation of that project based on knowing those risks.

“So there are quite a few different types of risks that a programme manager should be aware of and be able to articulate—whether they’re delivery project risks or whether they’re market risks—and then be able to continue to deliver that project.”

This exclusive interview with Gurps Khaira was conducted by Mark Matthews of The Motivational Speakers Agency.

The post Bridging Tech & Leadership: Gurps Khaira on Cyber Security, Risk & Results appeared first on European Business & Finance Magazine.