What your board actually wants to hear about cyber risk
Most board cyber updates fail the same way. A heat map, a count of blocked attacks, a maturity score, and a slide of vendor logos. The directors nod, nobody asks a question, and the security leader leaves the room with no decision made. The board did not get what it needed, which is an answer to three questions.
The three questions, in order
How exposed are we, and compared to what? Not a score. A short list of the scenarios that could materially hurt the business: ransomware that takes the ERP down for two weeks, a wire sent on a forged invoice from a compromised mailbox, a breach of customer data that triggers notification. For each one, a plain estimate of how likely it is, what it would cost, and whether that sits inside or outside the appetite the board has set. Directors manage risk in every other part of the business this way. Cyber should not be the exception.
What are we doing about it, and is it working? Progress against a plan with dates, not a list of activity. "Multi-factor authentication is on every external system as of August, two months behind plan because of the finance application migration" is a board sentence. "We closed 412 tickets this quarter" is not.
What do you need from us? A decision. Budget for a specific control, acceptance of a specific risk, approval of a policy, a hire. If the update asks nothing of the board, it is a report, not governance, and the board will treat it accordingly.
What to leave out
Blocked attack counts. Every firewall blocks millions of connections and the number says nothing about exposure. Vulnerability totals without context, for the same reason. Heat maps with unlabeled axes, because a red square with no scenario or dollar figure behind it cannot be prioritized against anything. Product and vendor names, because the board does not buy tools, it funds or accepts risk. And jargon. If a director could not repeat the point to a peer at dinner, it was not said.
A one-page structure that works
The strongest quarterly reports we have seen or written fit on one page, with everything else in an appendix nobody is obliged to read. Five sections:
Risk posture. The top five scenarios, each with likelihood, impact, the trend since last quarter, and a named owner. The trend column is the one directors actually read.
Program progress. Three to five milestones, planned date against actual, with the reason for any slip stated plainly. Slips are normal. Unexplained slips are what erode trust.
Incidents and near misses. What happened, what it cost, what changed as a result. Include the near misses. A quarter with nothing to report reads as a quarter nobody was looking, and a well-handled near miss is the best evidence the program works.
External obligations. Audits, certifications, insurance renewal, customer security reviews, and disclosure deadlines, each with a date. This is where a board learns that the cyber insurance renewal is in six weeks and the insurer now requires a control the company does not have.
Decisions requested. Listed, numbered, and specific enough to vote on.
Some things require a name, not a dashboard
Public companies now have to describe, in their annual filing, how the board oversees cyber risk and which members of management are responsible for assessing it and what their expertise is. Cyber insurers increasingly ask who reviews the program before they quote. Audit committees ask who stands behind the numbers on the page. None of those questions can be answered with a platform export. The report should carry a name, and that person should be in the room when the questions start.
For a mid-market company without a full-time security executive, that name is often the hardest part. The plan can be good and the controls can be real, but if the person presenting them cannot speak to the method behind the risk estimates or defend the trend line, the board will discount the whole thing. That is one of the clearest cases for an experienced outside security leader: not to run the program day to day, but to own the assessment and the reporting and to answer for it.
Cadence and consistency
Quarterly, in the same structure every time, so the trend is visible without anyone having to dig out last quarter's deck. Once a year, a deeper session: a refreshed risk assessment, the results of a tabletop exercise, and the insurance and disclosure posture for the coming year. And a written trigger for an out-of-cycle briefing, agreed in advance, so that a material incident, a major vendor compromise, or a regulatory change does not become a debate about whether the board should hear about it.
Done this way, the cyber update stops being the slot where directors check their phones and becomes one of the few places the board makes an actual risk decision with real numbers in front of it. We prepare board cyber reporting to this standard, or independently review what your team already produces, as part of our cyber risk assessment and board reporting work. If the board's next meeting is on the calendar and the deck is not, that is a good time to talk.