What Boards Get Wrong About Cybersecurity (And the 3 Questions That Fix It)

Most boards treat cybersecurity as a technical briefing they endure once a quarter. SEC rules now make it a fiduciary responsibility. Here are the 3 questions every director should ask.

This article is grounded in current advisory work, not retrospective analysis. Mark Lynd is a 5x CIO/CISO with Thinkers360 Top 10 global rankings across five disciplines simultaneously (currently #3 Data Center, #4 Cloud, #4 Security, #5 Cybersecurity, #7 Artificial Intelligence) and was ranked #1 globally in Cybersecurity in 2023. He is currently Head of Executive Advisory and Strategy at Netsync, advising enterprise C-Suites and boards on the AI and cybersecurity questions moving fastest in 2026. The frameworks and patterns referenced here are from active engagements this quarter.

The CISO-board relationship is broken in most organizations and the consequences are getting more expensive. SEC cybersecurity disclosure rules, harder regulator posture, board fiduciary duty around cyber risk, and the AI governance question converging with cyber governance have all moved the CISO conversation from quarterly update to quarterly decision. CISOs who present the same way they did in 2022 are getting replaced in 2026. The gap between technical fluency and board-grade communication is the most common reason it happens.

Board Communication that Produces Decisions

The board does not want a technical briefing. It wants a decision-grade communication that tells them what they own, what is on track, what is at risk, and what the organization is asking the board to fund or approve. The CISO-board communication framework I use covers four sections. Current Quarter Posture, what is the cyber risk state right now and how does it compare to the prior quarter. Material Disclosure Risk, what would trigger an SEC Item 1.05 obligation and what is the status of any active investigations. Investment Decision Surface, what specific funding or organizational decisions does the CISO need from the board this quarter. Regulatory and Insurance Horizon, what is changing in the regulatory environment and the cyber insurance market that affects the organization's posture.

The framework is built to produce a decision, not awareness. The board update ends with a specific ask. Approve the budget reallocation. Authorize the insurance program change. Acknowledge the disclosure posture for the next earnings cycle. Without an ask, the briefing is an information dump. With an ask, it is governance.

The Common Failure Modes

Three common CISO-board communication failures. First, the technical briefing problem. The CISO presents the work the team is doing rather than the decisions the board needs to make. Boards do not want to know about SIEM rule tuning. They want to know whether the organization is more or less exposed than last quarter. Second, the no-ask problem. The CISO presents quarterly material without specific asks. The board responds with engagement but cannot act because there is nothing to decide. Third, the false-confidence problem. The CISO presents only the good news. The board feels safe, the next incident exposes the gap, and the CISO becomes the person who did not warn the board. Calibrated honesty is more valuable than confident optimism.

SEC Disclosure and Board Fiduciary Duty

SEC cybersecurity disclosure rules changed the board fiduciary picture materially. The four-business-day disclosure window on Item 1.05 means the board has to be in the loop on material incidents in close to real time, not after the fact. The annual cybersecurity risk disclosure in Form 10-K means the board has to understand the cybersecurity governance structure well enough to attest to it. Board education on the SEC requirements is part of the CISO's job now, whether the CISO signed up for that responsibility or not.

What Good Looks Like in Practice

What good looks like in practice. The CISO produces a one-page board update for every quarterly meeting and a three-page audit committee update for every audit committee meeting. The update covers the four-section framework above with specific data, specific asks, and a calibrated read on what could change before the next meeting. The CISO also produces a 200-word emergency board update template that goes out at hour 12, hour 24, and hour 48 of any incident, with six fields: what we know, what we do not know, what we are doing about it, what could change in the next 12 hours, what we need from the board, and what the next update will cover.

What Boards and Executives Should Do Now

The pattern across engagements where the conversation translates to action: leadership treats this as a quarterly governance cycle rather than an annual policy review. The CISO and CIO bring a shared scoring view (the Enterprise AI Trust Score or the Cyber Insurance Readiness Score). The board asks specific questions rather than receiving a status update. The audit committee documents the decisions for the disclosure file. The result is governance that produces decisions instead of awareness.

Key Takeaways

• The CISO-board conversation has moved from quarterly update to quarterly decision. SEC disclosure rules and board fiduciary duty have changed the stakes.
• Board communication should produce decisions, not awareness. Every quarterly update ends with a specific ask: budget reallocation, insurance program change, disclosure acknowledgment.
• The four-section framework: Current Quarter Posture, Material Disclosure Risk, Investment Decision Surface, Regulatory and Insurance Horizon.
• Three common failure modes: the technical briefing problem, the no-ask problem, and the false-confidence problem. Calibrated honesty beats confident optimism.
• Emergency board updates use a 200-word template at hour 12, hour 24, and hour 48 of any incident. Six fields, every time.

Where This Came From

This analysis is grounded in direct advisory work, 150-plus facilitated executive tabletop exercises, and current operating responsibility as a 5x CIO/CISO. It is not a research report or a vendor white paper. It is the operator perspective on the topic, calibrated for the 2026 environment and the executive audiences that need decision-grade content.

Next Steps

Mark Lynd speaks on these topics at enterprise conferences, executive offsites, and board retreats. Sessions are tailored to the audience through a pre-event discovery call with the host or program chair. The named frameworks travel; the vocabulary, examples, and depth match the room.

Book Mark for your next event or explore all speaking topics.