Security leaders and boards usually talk past one another, and more information is not the fix. A different shape of information is.
I have spent a good part of my career on both sides of this conversation. I have built the board deck late at night, carrying in every detail I believed mattered, and I have sat in the room and watched a thoughtful group of directors work hard to find the decision somewhere inside forty slides. Neither side is doing anything wrong. Security leaders present the work, because the work is real and hard-won. Boards listen for position, because position is what they can act on. Both instincts are sound, and they pull in opposite directions.
Closing that gap is a learnable skill, and it has made me a more effective leader than any technical decision I have made. Here is the approach that has served me and the teams I have led.
Start From What Directors Are Trying to Decide
Directors ask a great many questions, and the wording varies by person and by industry. Underneath most of them sit four:
- Are we exposed in a way that could hurt the business?
- Are we spending a sensible amount, in sensible places?
- If something happened tomorrow, would we handle it well?
- Are we meeting the obligations we have taken on, whether regulatory, contractual, or tied to our insurance?
When I review my own material, I hold each section against those four questions. If a section does not help answer one of them, it is good work that belongs in the appendix rather than in the fifteen minutes we have together.
What Lands
Position first, then movement
There is a real difference between “we closed 1,400 vulnerabilities this quarter” and “our internet-facing exposure moved from eighteen critical findings down to three, and the remaining three are scheduled for the next maintenance window.” The first describes effort, and that effort was real and worth recognizing inside the team. The second tells a director where the organization stands, that it is improving, and that someone has a plan for what is left. Both are true. Only one is ready to be decided on.
A small set of measures you return to every time
Boards think in trends, so consistency serves them better than completeness. Pick a handful of measures and show the same ones every session: a maturity score against a recognized framework, time to remediate critical findings, phishing failure rate. There is a real pull toward swapping in whichever measure looks strongest in a given quarter, and I understand it. Directors read patterns well, though, and the swap costs more in credibility than the better number gains.
A clear ask
An update without an ask is a status report, and status reports are easy to receive and easy to set down. When you need funding, a policy ratified, a risk formally accepted, or visible support for a change that will be unpopular, say so directly and give the board what it needs in order to decide: the option in front of them, what it costs, and what happens if the decision waits a quarter.
What you have decided not to do
This is the element left out most often, and it is among the most valuable. Naming the risks you are accepting for now, and why, shows that you are making deliberate choices rather than responding to whatever arrived that week. It also puts the acceptance where it belongs, with the business and on the record, rather than resting quietly on your shoulders alone.
What You Can Leave Out
Industry threat news that is not about you. Directors read the same headlines we do. Where a public incident is relevant, the useful part is brief: here is what that attack would have hit in our environment, and here is where we stand on it.
Tool inventories. Nobody outside the function can judge whether a fifth detection product is warranted, and it is not a fair question to put in front of them. What a board is well positioned to weigh is whether the overall investment is proportionate to the risk it addresses.
Raw vulnerability counts. Large numbers without a denominator or a trend line create concern without direction, and that takes the conversation somewhere neither you nor the board intended to go.
Acronyms we have stopped noticing. This one catches all of us, because we live inside the vocabulary every day. Spelling terms out is not simplifying the material. It spares people from translating while they are trying to think.
A Shape That Works
Fifteen minutes of prepared material, with room for the discussion to run well past it, because the discussion is the point. A single summary page that stands on its own for the director who reads nothing else. And an appendix you bring every time and present rarely, so the depth is there the moment someone reaches for it.
Within that, four movements: where we stand, what has changed since last time, what I need from you today, and what we are accepting for now.
The Part That Takes Practice
The hardest part is not assembling the deck. It is deciding what a board can act on and setting the rest aside, and that is difficult, because the material you set aside is often the work you and your team are proudest of. What helped me was recognizing that leaving something out is not a judgment on its value. A board is a different audience with a different job, and serving that audience well is its own craft, distinct from the technical work and every bit as worth developing.
If you are finding it hard to describe your position cleanly, that is telling you something about the program rather than the presentation, and it is a fixable thing. A Security Maturity Snapshot produces exactly that picture: a scored position, the findings that matter, and a sensible sequence for addressing them. That is most of what a good board update is built from. Start there, and you will walk into your next board meeting with a position rather than a summary.