A CISO’s Guide to Board Reporting on Cyber Risk

Boards do not want to know how many vulnerabilities you patched. They want to know whether the organisation is taking the right amount of risk for the return — and whether the money they have given you is working. Reporting to that audience is a different skill from running a security programme, and it is one of the highest-leverage things a CISO can get right.

What boards actually care about

The metrics that land — and the ones that do not

Operational metrics — patch counts, blocked emails, alerts triaged — show effort, not outcome, and boards quietly tune them out. Translate instead into the language of risk and money: residual exposure, trend over time, peer or sector comparison, and risk reduced per pound spent. One well-framed financial figure beats a dashboard of vanity metrics. Our guide to cyber risk quantification covers exactly how to produce that figure.

A reusable board-pack structure

Tell a story, not a status update

The strongest board reports read as a narrative: here is where we were, here is what changed, here is what it means, and here is what we need from you. Lead with the conclusion, support it with two or three numbers, and keep the detail in an appendix for the directors who want it. Consistency matters too — use the same structure every quarter so the board can see trends at a glance rather than relearning your format each time.

Avoid these traps

The bottom line

Board reporting is where security earns its budget and its seat at the table. Speak in risk and money, show the trend, tie spend to outcomes, and always end with a clear ask. Do that consistently and the conversation shifts from “why does security cost so much?” to “what else should we be investing in?”