Board-Level Challenges in Understanding and Communicating Cybersecurity Risk
A significant disconnect exists between board members, particularly non-executive directors (NEDs), and cybersecurity leadership regarding the value and impact of cyber investments. Studies reveal that only 10% of NEDs express strong confidence in the effectiveness of cybersecurity spending, with many citing difficulties in linking technical risk metrics to tangible business outcomes. Experts emphasize that CISOs must translate technical information into business-focused language, quantifying cyber risk in terms of potential financial loss and strategic impact to facilitate better board understanding and decision-making.
Industry leaders recommend that CISOs aggregate signals from identity, infrastructure, cloud, and application security systems to create a comprehensive risk index. This index should be presented in a way that aligns with the board's oversight responsibilities, focusing on risk appetite, loss scenarios, and the business implications of exceeding risk thresholds. Improved communication and transparency are seen as essential for boards to make informed decisions about cybersecurity strategy, resource allocation, and future investments.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
2 events from the most recent confirmed update back to the earliest known activity.
Experts urge CISOs to reframe cyber metrics for boards
Following the Gartner findings, security leaders emphasized that CISOs should present cybersecurity in business terms such as risk, resilience, compliance impact, and ROI rather than technical metrics. They recommended concise, value-oriented board communication, including measurable examples like identity and privileged access management improvements.
Gartner reports low board confidence in cybersecurity investment value
A Gartner study dated 2025-11-24 found that 90% of non-executive directors lacked confidence in the value delivered by cybersecurity investments, with only 10% strongly confident that protection and cost were appropriately balanced. The study highlighted boards' difficulty linking cyber spending to business outcomes.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
See the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybersecurity Leadership Communication and Guidance Challenges
A significant gap exists between board members and cybersecurity leaders regarding confidence in cybersecurity investments and risk management. Research from Gartner highlights that 90% of non-executive directors lack strong confidence in the value of cybersecurity, often due to difficulty connecting technical details to business outcomes. CISOs and CIOs are increasingly called upon to bridge this gap, providing clarity on exposure levels and threat readiness to help boards make informed decisions that align with organizational growth and regulatory expectations. In parallel, the evolving role of cybersecurity leaders emphasizes the importance of mentorship and coaching to develop both technical and executive skills. Experienced CISOs, such as Renee Guttmann, advocate for structured mentoring and coaching relationships to help emerging leaders navigate complex interactions with senior executives and build the confidence needed for effective communication. These efforts are seen as essential for preparing the next generation of cyber leaders to address both technical and business challenges in a rapidly changing threat landscape.
Mar 21, 2026
Executive-Level Cybersecurity Management and Investment Justification
CISOs are increasingly required to align cybersecurity investments with broader business objectives, focusing on how security initiatives can drive revenue, mitigate risk, and support strategic priorities. Board-level discussions now demand that security proposals demonstrate clear value in terms of operational resilience, cost efficiency, and compliance, rather than being framed solely as technical upgrades. Decision-making at the executive level is often influenced by recent incidents, regulatory pressures, and the need to show due diligence, rather than purely by rational risk or ROI calculations. This dynamic places CISOs in a position where they must communicate the business impact of security investments and navigate organizational biases to secure necessary funding. Risk quantification and management are becoming essential tools for CISOs to justify resources and prioritize security initiatives. Approaches such as cyber risk quantification (CRQ) and the establishment of risk operations centers (ROCs) are being explored to provide tangible metrics for board discussions and to proactively address risks before they materialize. However, challenges remain in effectively implementing these frameworks and ensuring that security leadership is empowered to drive enterprise risk decisions. The evolving landscape underscores the need for CISOs to adopt a business-centric narrative and to integrate security strategy with overall organizational goals.
Mar 21, 2026
Board-Level Cybersecurity Governance and Executive Risk Visibility
European and UK regulatory pressure is pushing cybersecurity from an IT function into **board-level accountability**, with frameworks like **NIS2** and UK cyber resilience policy expectations emphasizing management oversight and demonstrable cyber-risk governance. Reporting focused on operational metrics (e.g., patch counts, vulnerability totals, tool deployment) is increasingly viewed as insufficient for executives because it does not show whether enterprise risk exposure is trending up or down; guidance and industry outlooks highlight the need for measurable, business-aligned KPIs that support defensible oversight and investment decisions. Cloud environments amplify this governance challenge because **unknown or unmanaged assets** (shadow accounts, orphaned identities, forgotten data stores, and third-party integrations) can sit outside monitoring, IAM governance, and incident response processes, creating “invisible” attack surface and compliance exposure. A commonly cited failure pattern is data exposure from an abandoned or untracked cloud subscription where no sophisticated exploit is required—risk materializes because the organization cannot inventory what it owns—reinforcing that real-time asset discovery and visibility are prerequisites for credible cloud security and board reporting.
Mar 21, 2026