The short answer: directors do not want to know how many alerts your team closed. They want answers to a handful of business questions: how exposed are we, what could a serious incident cost us, are we getting better or worse, where do we depend on others, and what decisions do you need from us. A good board cyber report is short, written in business language, shows trends rather than snapshots, ties cyber risk to money and operations, and ends with a clear ask.
See how a single cyber maturity score simplifies your board report →
Why most board cyber reports miss the mark
Picture a typical quarterly board pack. Somewhere between the finance update and the audit committee minutes sits a security section with twenty slides. It shows the number of phishing emails blocked, the count of vulnerabilities patched, a heat map of risks in red, amber and green, and a list of projects marked "on track".
The directors read it, nod, and move on. Nobody asks a question, because nobody is quite sure what question to ask. This is the most common failure in cyber governance, and it is not the fault of the directors. The report answered questions they never asked.
In Proofpoint's 2023 survey of 659 board members across 12 countries, 73 percent of directors said they felt their organisation was at risk of a material cyberattack, up from 65 percent the year before. Yet 72 percent also said their board clearly understood the cyber risks it faced. Directors feel exposed and confident at the same time. That contradiction is usually a sign that the information reaching the board describes activity, not risk.
Counts of blocked attacks, tickets closed and scans run describe effort. They do not tell a director whether the organisation is more or less likely to suffer a damaging incident than last quarter.
Terms like CVSS, EDR, SIEM and lateral movement mean nothing to most directors. If a board member has to ask what an acronym means, the report has already lost them.
A single number on a single day is almost meaningless. Boards make decisions on trends. Is risk falling, rising or flat, and why?
What boards are now expected to oversee
Board cyber reporting is no longer only good practice. In the United States, the European Union, the United Kingdom and India, regulators now expect boards to understand, approve and oversee cyber risk, and in some cases to be personally accountable for it.
Across all of these, three expectations repeat: the board must understand cyber risk in terms it can act on, approve the approach and risk appetite, and be able to show that it oversaw that risk over time. A report that lists blocked emails meets none of these.
What directors actually want to know
The 2023 NACD and Internet Security Alliance Director's Handbook on Cyber Risk Oversight groups board metrics into five areas. They map neatly onto five questions every director is really asking.
What is the threat environment, and has it changed?
Not a list of attacks. A short view of who is targeting businesses like yours, what methods they are using, and whether anything has shifted since the last meeting.
If your report answers these five questions clearly, it is better than most board packs in the market.
The board metrics that actually work
You do not need all of these. Pick the few that fit your organisation and report them consistently so the board can see trends.
Every metric on a board slide should pass the "so what" test. If a director could reasonably ask "so what does that mean for us?" and the slide does not answer it, the metric belongs in a management report, not a board report.
Stop showing this, start showing that
The fastest way to improve a board report is to swap operational numbers for their business equivalents.
Many boards take comfort from a clean audit or a renewed certification. As we explained in Security Posture vs Compliance Status, compliance tells you a standard was met when an auditor looked. It does not tell the board how well protected the business is today. A good board report shows both, and is honest about the difference.
Translating technical findings into business language
Here is the same finding written two ways.
We have 47 unpatched critical CVEs on internet facing assets, mean time to remediate is 38 days against an SLA of 15.
Several systems customers use to reach us have serious, known weaknesses that attackers actively look for. On average we are taking more than twice our own target time to fix them. If one were exploited, the most likely outcome is a service outage lasting several days and a reportable data incident.
The second version answers four things a director needs: what the problem is, why it matters to the business, what could happen, and what is being done about it.
In one plain sentence.
In terms of customers, revenue, operations or regulators.
And how likely it is.
By when, and what we need from the board, if anything.
A one page board cyber report structure
The full board needs a short, strategic view. A risk or audit committee may need more detail. One way to apply that is to build the board's view on a single page, with appendices for anyone who wants to go deeper.
Two or three sentences on overall position and direction.
One headline measure over four to eight quarters, with the biggest drivers of change.
Three to five scenarios with impact, financial exposure, trend and owner.
What has changed outside that affects the organisation. Keep it to a few lines.
Anything significant since the last meeting, cost or potential cost, and what was learned.
Critical vendors, assessment status, and concentration risk.
Upcoming obligations and audit findings as context, not as proof of security.
Approvals, acceptances or investments needed, each linked to the risk it addresses.
If the board pack can only fit one section, make it section 8. A report that does not ask for anything is a report the board does not need to read.
How often to report, and to whom
Most boards receive a cyber update at least quarterly, and some regulators set that rhythm directly. The RBI, for example, expects the IT Strategy Committee of a regulated entity to meet at least once a quarter.
To the board or the relevant committee, using the one page structure above.
A deeper review of strategy, risk appetite, major investments and independent assessment results.
When a significant incident occurs. US public companies may have only four business days from determining materiality to disclose.
Delegating detail to a committee does not delegate accountability. The SEC rules require US public companies to say which committee is responsible, and DORA and NIS2 place responsibility on the management body as a whole.
Five myths about board cyber reporting
More data makes a better report.
The opposite is usually true. Directors trust a short report with a clear trend more than a thick pack full of charts.
The board needs technical detail to oversee cyber risk.
It needs enough understanding to ask good questions. That comes from clear framing and training, not CVE counts.
A green heat map means we are safe.
Colours are opinions, not measurements. A trend backed by evidence is far more reliable.
A clean audit means the board has nothing to worry about.
An audit confirms a standard was met at a point in time. Breaches happen in the months between audits.
Cyber belongs at the end of the agenda.
Cyber risk is business risk. It should inform strategy, acquisitions and product launches, not only sit in its own slot.
Questions every director should be able to ask
A good report prepares the board to ask, and management to answer, questions like these.
What are our most valuable digital assets, and what would it cost if they were unavailable for a week?
Is our cyber risk position better or worse than a year ago, and how do we know?
Which of our critical services depend on a single outside provider?
How long would it take us to recover from a ransomware attack, and when did we last test that?
What risks have we formally accepted, and who accepted them?
How do we decide whether an incident is material, and how quickly could we disclose one?
Where would the next unit of security investment reduce the most risk?
What independent assurance do we have that what we are being told is accurate?
If management cannot answer these clearly, the gap is not in the report. It is in the measurement underneath it.
Where a cyber maturity score fits
The hardest part of board reporting is not presentation. It is having one reliable, consistent measure of the organisation's position that can be tracked over time. Without it, every quarter's report starts again from a different set of numbers, and the board never sees a real trend.
An evidence based cyber maturity score solves that problem when it is built from evidence rather than self assessment. It gives the board one number for direction, while the detail underneath shows which areas are driving it. Because cyber maturity rests on the combined strength of people, process and technology, a good score also tells directors which of the three is holding the organisation back.
Frameworks support this too. The NIST Cybersecurity Framework 2.0 added a Govern function that places cyber risk strategy, roles and oversight at the centre of the framework, and its implementation tiers give boards a familiar way to describe where the organisation is and where it intends to go.
Frequently asked questions
How do you report cybersecurity to the board?+
Keep it short, use business language, show trends rather than snapshots, express risk in financial and operational terms, and end with clear decisions the board needs to make. A one page summary with supporting appendices works well for most organisations.
What cybersecurity metrics should be reported to the board?+
Metrics that answer business questions: overall cyber risk or maturity trend, top risk scenarios with estimated financial impact, critical exposures open beyond target, essential control coverage, time to detect and contain incidents, critical vendor exposure, and decisions or risk acceptances required.
What metrics should not be shown to the board?+
Pure activity counts, such as phishing emails blocked, vulnerabilities patched or tools deployed, unless they are translated into what they mean for business risk. These belong in management reporting.
How often should the board receive a cybersecurity report?+
At least quarterly for most organisations, with an annual deep review and immediate escalation for significant incidents. Some regulators, such as the RBI for its regulated entities, set quarterly oversight expectations directly.
What does the SEC require boards to disclose about cybersecurity?+
Public companies must describe in their annual report how the board oversees cybersecurity risk, which committee is responsible, and how the board is informed. They must also disclose material cybersecurity incidents within four business days of determining they are material.
Are directors personally accountable for cyber risk?+
Increasingly, yes. NIS2 states that management bodies can be held liable for infringements of its cybersecurity risk management obligations, and DORA gives the management body of a financial entity ultimate responsibility for ICT risk.
What is the NACD cyber risk oversight framework?+
It is guidance from the National Association of Corporate Directors and the Internet Security Alliance for boards overseeing cyber risk. Its metrics toolkit covers the threat environment, economic loss exposure, cyber risk profile, supply chain exposure, and how cyber risk should inform business decisions.
How do you explain cyber risk in business terms?+
For each finding, state what was found, why it matters to customers, revenue, operations or regulators, what could happen and how likely it is, and what is being done about it. Avoid acronyms and technical counts.
What is a good single metric for board cyber reporting?+
An evidence based cyber maturity or posture score, tracked over time, is one of the clearest single measures because it shows direction and can be broken down into the areas driving it.
Should the board see compliance status or security posture?+
Both, clearly separated. Compliance shows whether standards were met when assessed. Posture shows how well protected the organisation is now. Relying on compliance alone can give the board false comfort.
Why Bugmetrics
Boards are being asked to oversee cyber risk more closely than ever, but most of the information that reaches them was built for security teams, not for directors. At Bugmetrics, we believe cyber risk should be as easy for a board to follow as financial performance.
A consistent view directors can compare from one quarter to the next, not a new set of numbers every meeting.
See where the organisation stands, which way it is moving, and which areas are driving the change.
Compress technical signals into business language so security leaders can brief directors without translating mid meeting.
Detail for the team, a clear score for finance and the board, one source of truth underneath.
That gives security leaders a reliable foundation for their board reporting and gives directors what they have been asking for all along: a straight answer to whether the business is getting safer, and where the next decision should be made.
See how your board could view cyber risk →
Sources: National Association of Corporate Directors and Internet Security Alliance, Director's Handbook on Cyber Risk Oversight, 2023 edition; US Securities and Exchange Commission, Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure final rule, July 2023; Regulation (EU) 2022/2554 (DORA), Article 5; Directive (EU) 2022/2555 (NIS2), Article 20; UK Department for Science, Innovation and Technology and the National Cyber Security Centre, Cyber Governance Code of Practice, April 2025; Reserve Bank of India, Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices, November 2023; SEBI Cybersecurity and Cyber Resilience Framework, August 2024; Proofpoint, 2023 Cybersecurity: The Board Perspective; Verizon 2025 Data Breach Investigations Report; IBM Cost of a Data Breach Report 2025; and the NIST Cybersecurity Framework 2.0. Figures are cited as published by their sources. General information only, not legal or regulatory advice.