Communicating Cyber Risk at the Board Level: 7 Lessons for 2025

TL;DR‍

• Cyber risk is a business risk, and chief information security officers (CISOs) and other cyber leaders must translate technical jargon into business terms that resonate with board members.

• To do so, CISOs must invest in their communication skills to ensure that complex cyber metrics are reframed into metrics such as financial impacts, operational risks, and business continuity.

• For more tailored cybersecurity board presentations, cyber leaders can make an effort to understand each board member's unique experience, subsequently crafting narratives that resonate with these priorities.

• Monetary metrics also make cyber risk more tangible, helping to cut through the noise that typically takes over boardroom-level meetings.

• Quantifying potential threats with models like on-demand cyber risk quantification (CRQ) can provide clear insights into an organization's risk exposure and the ROI of proactive investments.

• CISOs should set realistic expectations for board members by focusing on the ability to detect, respond, and recover rather than promising the myth of total defense.

• By positioning cybersecurity as a business enabler that supports growth and operational excellence rather than a reactive cost center, cybersecurity can make a much larger impact on boardroom decisions. 

‍

‍Experts Share Their Cybersecurity Board Reporting Insights ‍

‍

As digital threats grow more sophisticated and cyber regulations expand in scope, business stakeholders are beginning to recognize the need to learn more about cybersecurity and how it impacts organizational performance. With this recognition comes the elevation of chief information security officers (CISOs) into the boardroom, tasked with explaining these cyber intricacies and offering strategies that can help safeguard operational resilience and drive long-term growth.

‍

While this integration of cyber into high-level meetings is a positive professional step forward, it also comes with its fair share of challenges, not least of which includes bridging the gap that exists between the technical jargon the CISO is used to speaking and the business-oriented language that resonates more so with board members. Indeed, many cybersecurity leaders are now finding themselves confronted by this issue, unsure of how to effectively communicate the information these stakeholders need to carry out their governance and oversight responsibilities. 

‍

In the midst of this ongoing obstacle, the market’s seasoned CISOs and cyber risk managers have been sharing their insights, offering practical strategies and proven techniques for translating complex cyber risks into clear, actionable narratives that drive informed decision-making at the board level. Their collective wisdom sheds light on how cybersecurity leaders can not only overcome communication barriers but also establish themselves as trusted advisors, keeping the business resilient and ensuring that cyber is regarded as a mission driver rather than a cost center.

‍

Lesson 1: Apply the Art of the Cyber Trade

‍

On the podcast Free the CISO, Kirsten Davies, former CISO at Unilever and Founder of the Institute for Cyber Civics, underscores the importance of harnessing both the science and art aspects of one's cybersecurity position in the boardroom. Instead of bogging the board down with metrics regarding controls and vulnerabilities or what Davies refers to as "the deep eye-watering details," which are unquestionably important in certain circumstances, CISOs need to focus on the art of communication.

"In the boardroom…the CISO has to be the translator in order to help the board interpret what exactly is the risk posture of the organization," says Davies. If boards don't have a tangible understanding of the organization's cyber exposure, they will inevitably be unable to make informed decisions about allocating resources and prioritizing tasks. Reporting cybersecurity to the board requires more than highlighting technical achievements; it involves presenting a clear picture of how cyber risks can affect the business's bottom line.

‍

Access Kovrr’s free cybersecurity reporting template, providing specific guidance on which cybersecurity metrics for the board are the best to utilize.

‍

Lesson 2: Tailor the Message to the Boardroom’s Makeup

‍

Brian Miller, CISO at Healthfirst, recommends that cybersecurity leaders "tap into the communication strategies that are tailored [specifically] to their boards." Every board member brings a distinct set of expertise and perspective to the organization, making it essential for CISOs to adapt their messaging accordingly. A cybersecurity board report that is effective in one context may not necessarily be so in another. 

‍

To ensure their presentations resonate, even after translating complex metrics into broader business terms, cybersecurity leaders can go even further and get to know board members individually, whether through direct conversation or via research into their professional backgrounds. Leveraging the insights, CISOs can craft narratives that align with each member's experiences. For instance, a board member with a legal background might appreciate a focus on regulatory compliance and its value, while someone from the wholesale services industry might connect with stories about preserving the supply chain. 

‍

By tailoring their communications to reflect the interests and professional foundations of their organization's board members, CISOs can make their messaging more impactful and drive meaningful engagement at the highest levels.

‍

Lesson 3: Transform Cyber Risks Into Monetary Metrics

‍

One of the most straightforward ways to make an impact in the boardroom is to harness the power of monetary metrics. While each has a distinct mission, most businesses are attempting to make a profit, making finances one of the key motivators behind overarching decisions. Unfortunately, when cyber metrics are typically delivered to the board in their original form, board members are often left in a state of confusion.

‍

Chief Executive Officer at Access Point Technology and Cybersecurity Board Advisor to four US Fortune 50 companies, Geoff Hancock, offers a remedy: "The boardroom energy shifts when I start translating cybersecurity risks into financial terms. Suddenly, data breaches [aren’t] abstract—they [are] million-dollar risks." When boards understand the financial implications of cyber threats, such as potential revenue loss, regulatory fines, or recovery costs, they are far better equipped to prioritize cybersecurity initiatives. 

‍

Nikoloz K., Head of Corporate Security & Cybersecurity Operations at Mambu, agrees with Hancock, advising that “to get the board’s attention, [cybersecurity leaders] need to translate security metrics into financial impact.” Framing cybersecurity in terms of dollars and cents not only clarifies its importance but also positions it as a strategic business investment rather than a purely technical expense.

‍

Lesson 4: Harness Cyber Risk Quantification (CRQ)

‍

In his Perspectives on Security for the Board, Phil Venables, CISO at Google, provides many tactics for CISOs in their quest to help foster an understanding of cyber risk in the boardroom and embed cybersecurity awareness into the company culture, the first of which is to leverage cyber risk quantification models. Venables proposes that cyber leaders “develop clear methods to assess the financial impact of potential cyber threats, translating technical jargon into business consequences that help decision-makers understand the overall cyber risk exposure.”

‍

With quantified metrics, boards gain a clearer picture of how cyber risks align with business priorities, allowing them to more easily weigh the potential costs of threats against the resources required to mitigate them. Beyond this, quantification enables CISOs to project not only the cost of inaction but also the long-term value of sustained investment in cybersecurity. For example, instead of focusing solely on potential breach costs, CISOs can model scenarios that show how proactive investments lead to year-over-year financial benefits, such as reduced downtime.

‍

‍

This forward-looking perspective, illuminated with on-demand CRQ solutions, reframes cybersecurity as a continuous value-add to the organization, helping board members see how it supports innovation and operational excellence rather than simply serving as a reactive measure. By quantifying these broader impacts, CISOs can elevate cybersecurity discussions from necessary expense to strategic advantage.

‍

Lesson 5: Make Cyber Actionable

‍

Inga Stirbyte, a seasoned Information Security Officer currently working at WorkBoard Inc., also recognizes the critical challenge that CISOs face in translating technical risks into a business language and offers her expert insights into how to overcome this obstacle. Like her peers, she advocates using "metrics that matter…[meaning] financial impact, and not just vulnerabilities." However, she also adds that it's equally important to frame these metrics in an actionable way.

‍

Stirbyte emphasizes that cybersecurity leaders should:

‍

• Present clear solutions to stakeholders, as opposed to problems and standalone KPIs.
• Align cyber investments with business priorities and overarching strategic goals.
• Showcase the ROI of various security initiatives, demonstrating how they enable growth and resilience.

‍

For instance, instead of reporting a statistic like "82% of systems patched," which is undoubtedly a sizeable accomplishment, CISOs can frame it as how improved patching coverage has significantly reduced the likelihood of business interruptions. Therefore, if stakeholders want to minimize this likelihood even further, they can allocate resources to patching programs, clearly maximizing this correlation. Ultimately, by calling attention to the more practicable insights, cybersecurity leaders can position themselves as strategic, purpose-driven partners in the boardroom. 

‍

Lesson 6: Create Realistic Expectations of the Cyber Program

‍

The only way to completely avoid cyber risk is to cease all digital activities. Considering that the vast majority of businesses nowadays rely on the cloud to execute critical business functions, this avoidance is an impossibility, one that the boardroom needs to intrinsically understand. "No company is immune to cyber incidents," explains Carl Erickson, former Fortune 150 Global CISO, "and every organization has a non-zero chance of a material breach or ransomware event."

‍

Cybersecurity leaders must ensure that the board acknowledges this reality by setting clear and realistic expectations. Rather than promising perfect protection or that events will never occur, CISOs should emphasize the organizations' capacity to detect, respond to, and recover from incidents effectively and efficiently. They can also outline the specific measures in place to reduce an event's likelihood and impact, such as robust backups, incident response plans, and employee training. The best way to create this common understanding is through transparent, honest communication. 

‍

Lesson 7: Clarify the ‘Ask’

‍

Effective communication between a CISO and the boardroom often requires more than delivering a compelling narrative; it also demands a clear and specific “ask.” Jigar Shah, Global Head of IT, Identity, Access, and Application at Tenet Healthcare, highlights the importance of defining what one needs from the board, whether it’s budget approval, policy endorsements, or strategic alignment. Without a well-articulated request, proposes Shah, even the most engaging cybersecurity board report will leave stakeholders feeling uncertain about the next steps. 

‍

To help ensure that the board fully understands what the request is, CISOs should focus on the following criteria: 

‍

1. Defining the Need: Be explicit about what is needed from the board. Shah emphasizes that board members operate best when given clear decisions to make rather than vague recommendations.
2. Connecting the ‘Ask’ to Business Goals: Frame the request within the context of the organization’s priorities. For example, if asking for additional funding for a new solution, explain how the solution helps bolster objectives such as operational resilience. 
3. Supporting the Need With Outcome-Driven Metrics: Leverage data that demonstrates the proposed action's ROI. In his article "CISO and Board Chemistry," Shah notes that discussing cybersecurity in terms of value creation is far more persuasive than discussing technical tactics alone.

‍

Clarifying one’s ask not only streamlines the board’s decision-making process but also helps to build trust and credibility. By aligning the request with the organization’s goals and presenting them with precision, it’s much easier to secure the resources and support necessary to enhance both cybersecurity and business resilience. 

‍

‍Reporting Cybersecurity to the Board: Aligning Risks with Business Goals

‍

‍Because cybersecurity has so quickly evolved from a technical necessity into a critical business enabler, the role of the CISO has become more pivotal than ever before, requiring a communication approach in boardrooms that connects cyber risks and their management to the organization’s overriding priorities. As opposed to delivering metrics and technical details in the typical format, cybersecurity leaders must reframe their language to highlight cyber risk management’s relevance to operational resilience, customer trust, and strategic growth.

‍
CISOs can leverage the myriad of lessons outlined by the cyber experts in this article to build stronger relationships with board members and foster a shared understanding of cybersecurity’s role in driving the business. Tailoring communications to resonate with the board’s unique perspectives, aligning strategies with high-level objectives, and showcasing the tangible value of security investments are all key to gaining trust and buy-in. Through these approaches, CISOs can position themselves not only as team players but as drivers of the organization’s long-term success.

‍

To learn more about cybersecurity board reporting, download Kovrr’s free cyber risk board report template or schedule a demo with one of our cyber risk management experts.

‍