@Evgeny Belenky To communicate to executive mgmt it would definitely be a PowerPoint presentation.
At a high level, you would need to display the risk of not buying a tool. You'd need to pull data from past events for the last year (ransomware etc) that caused impact or in our case disrupted patient care.
Or you could go the generic route and show multiple reports from media reporting to the increase of specific cyber threats that you're attempting to buy a counter-measure to (EDR, NDR, IDS, etc).
You need to make a case as to whether the result outweighs the risk.