Cybersecurity Metrics for the Board Are Not Enough
See how to turn cybersecurity metrics into a board decision by showing the exposure, who owns it, and how long the decision has been open.
Open almost any board cybersecurity deck and you will find a dashboard lifted straight out of the security operations center. Blocked intrusions, patch compliance, phishing click rates, endpoint coverage. Twenty, thirty, sometimes forty numbers on one slide, shrunk to eight-point font so they fit.
Someone asks whether green is good. The CISO says yes. The slide advances. Fifteen minutes later, the board has seen plenty of cybersecurity metrics and still has to ask whether the company is safer than it was last quarter.
The metrics I’d put in front of directors are the ones that show what the company stands to lose, how the exposure has changed, who owns it, and what decision is due. If a number can’t answer one of those questions, keep it in the operating dashboard.
What directors need from a cybersecurity metric
A dashboard tells the people running the program where to put their attention this week. Directors need enough context to judge whether the exposure is acceptable and whether the people responsible have what they need. The NACD’s board metrics guidance asks management to translate technical data into business terms directors can use.
A phishing click rate of 4 percent is a number. What could a successful campaign against the finance team do to the company’s ability to make or approve payments? That’s where the discussion starts.
Is 94 percent patch compliance good? Compared to what? The value is in the trend, and a trend only makes sense if the definition and scope stay comparable. Bring directors the same measures over time. If the denominator changes, tell them what changed.
Finally, name the person who owns the exposure and the threshold or deadline that calls for a decision. Then tell the board what you need from it. That might be funding, a change to the risk tolerance, or a follow-up date for an issue that management has authority to handle.
How long has the decision been open?
Security teams measure detection time, response time, and recovery time. I think boards should also look at decision latency, the time between management having enough evidence to frame a risk decision and an authorized person making it.
The security team identifies an exposure. Technology proposes a fix. The business resists downtime. Finance questions the investment. Everyone is working. Weeks pass while the technical condition stays the same.
Start the clock once management can explain the exposure, the options, and their tradeoffs. Stop it when the authorized decision maker chooses a course of action and assigns an owner and date. Track the time it takes to complete the fix separately. Complex decisions can take time. The measure helps directors see where an unresolved decision is holding up work.
One board item before and after
This example is fictional. The company reviews the same class of internet-facing systems each quarter.
| Operating dashboard | Board briefing | |
|---|---|---|
| What changed | Patch compliance is 94 percent. | Seven of 112 internet-facing systems have at least one unpatched critical vulnerability, up from three of 108 last quarter. |
| Why it matters | Critical vulnerabilities are yellow. | One of the seven is the customer payments portal. An exploit that disrupts the portal could interrupt collections at month-end. |
| Who owns it | No owner shown. | The CIO owns remediation. In this example the COO can approve the maintenance window. |
| How long it has waited | No decision date shown. | Management presented the options 41 days ago. The maintenance decision is still open. |
| What happens next | Review next quarter. | The COO decides by Friday whether to authorize the window. If the window is deferred, management records the exposure and follows the company’s risk escalation process. The audit committee asks for the decision and the verification date. |
The CIO estimates three days to complete and verify the work once a window is approved. The 41 days tell the board something the patch metric couldn’t show. The question to ask in the room is what is keeping the COO from making the call.
If management decides to carry the exposure temporarily, a risk acceptance ledger records who approved it and when the decision comes back for review.
The four hours that taught me the point
Years ago at Silicon Valley Bank, the board asked me for a four-hour cybersecurity update. Four hours.
I had my direct reports take turns presenting so they could spend time with the directors. At the end we turned the concepts we had taught into a game of cybersecurity Jeopardy. We had the music, the buttons, and champagne for both teams. The directors were laughing and cheering.
I wanted them to understand the concepts well enough to talk through a decision. The same test applies to a board report. When directors can debate the scenario in their own words, they can do something with the evidence you brought them.
Take one slide from your next deck. Ask what decision a director could make after reading it. Then add the exposure, the owner, and the decision date if they’re missing. The cybersecurity board reporting guide and template gives you a place to put that information. If your team needs ongoing help translating security findings into leadership decisions, see vCSO.ai’s fractional CISO leadership service.
