What a Board Actually Wants From a Cyber Briefing
This is for CEOs, CTOs, and security leaders preparing a cyber briefing for a board of directors. Boards want three things: the risks that could hurt the business, stated in dollars; an honest view of whether those risks are shrinking; and a clear recommendation they can approve or challenge. Everything else is supporting detail.
What question is the board really asking?
Under the formal agenda, directors are asking something simple. Are we reasonably protected? How do you know? What do you need from us? A briefing that answers those three questions in the first five minutes has done its job. The rest of the time is for discussion.
Why state risk in dollars?
Boards make decisions in money. A heat map with red and yellow squares does not tell a director whether a risk is worth a $300,000 investment. A statement like "we estimate a serious ransomware event would cost us between $2 million and $6 million" (illustrative figures) gives them something to weigh against the cost of reducing it.
The numbers will be estimates, and you should say so. Give a range, state your main assumptions, and say how confident you are. Structured methods exist for this. FAIR (Factor Analysis of Information Risk) is an open standard maintained by The Open Group. You do not need a full quantitative program to start. A reasoned range is more useful than a color.
What belongs in the briefing?
Keep it to a few pages of pre-read and a short presentation. Cover the top three to five risks in business terms, what has changed since the last meeting, any incidents or near misses and what you learned, progress against the plan the board approved last time, and one recommendation with its cost and the risk it reduces.
If there is something you recommend stopping, say that too. Boards trust leaders who cut as well as add.
Why bring a recommendation instead of a list of options?
Management's job is to recommend. The board's job is to question, then approve or push back. When you present five options with no preference, you hand the board a management decision it is poorly placed to make, and you signal that you have not made up your mind.
You can still show alternatives. Present your recommendation first, explain why you chose it, and briefly note what you considered and rejected. That respects the board's time and invites better questions.
What should you leave out?
Leave out product names, counts of blocked attacks, and acronyms without explanation. A line like "we blocked 40,000 phishing emails" sounds impressive and says nothing about risk. Leave out fear, too. A calm, specific briefing earns more trust than a dramatic one.
Is there a regulatory reason to get this right?
For U.S. public companies, yes. In July 2023 the SEC adopted rules requiring annual disclosure of material information about cybersecurity risk management, strategy, and governance, including how the board oversees cyber risk. Private companies are not covered by that rule, but investors, lenders, and acquirers often ask similar questions in diligence. A clear record of board briefings helps either way.
Takeaway: tell the board what could hurt the business, roughly what it would cost, and the one thing you recommend doing about it.
If you have a board meeting coming up and want a second set of eyes on the briefing, request a call with AZEN.