15 minutes. Three things to know. Three decisions for the board.
Presenter: [CISO Name], Chief Information Security Officer
Audience: Board of Directors / Audit Committee / Executive Team
Period covered: [QUARTER]
What changed since last quarter that the board should know about.
Phishing emails are fluent, personalized, and arrive at machine speed. The Hong Kong $25M deepfake wire fraud is the new normal pattern.
Most major 2024–2025 incidents started with a valid login (Snowflake customers, MGM, MOVEit). Attackers log in; they don't break in.
Change Healthcare, MOVEit, XZ Utils: vendor compromises now produce industry-wide outages and regulatory headaches.
The defining shift: less "sophisticated zero-day," more "stolen identity meets unpatched vendor."
| Area | Status | One-line explanation |
|---|---|---|
| Identity & access | [Strong / OK / Gap] | [e.g., "MFA on 98% of accounts; passkeys rolling out Q[X]"] |
| Endpoint & cloud | [Strong / OK / Gap] | [e.g., "Modern EDR deployed; cloud posture has known drift"] |
| Third-party risk | [Strong / OK / Gap] | [e.g., "Top 20 vendors assessed; long tail unmapped"] |
| Data & AI | [Strong / OK / Gap] | [e.g., "AI policy live; shadow AI signal increasing"] |
| Incident response | [Strong / OK / Gap] | [e.g., "IR plan tested last [MONTH]; tabletop scheduled"] |
| Awareness & culture | [Strong / OK / Gap] | [e.g., "Phish report rate [X]%, click rate [Y]% — improving"] |
The board's exposure: regulatory (state AI laws, EU AI Act), data leakage (employees pasting customer data into public AI), and product risk (AI features we ship to customers).
For public companies: SEC's 4-day disclosure rule (Item 1.05) requires reporting material cyber incidents within 4 business days of materiality determination. For private companies: contracts, insurance, and state laws increasingly require similar timelines.
Our most likely path to a major incident isn't a direct attack — it's a vendor we trusted that gets breached and takes us down with them.
[N] vendors with access to sensitive data. Top [N] cover [P]% of risk by concentration. The long tail is our blind spot.
Change Healthcare — broke US prescription processing for weeks. Snowflake customers — credential-stuffing campaign hit 165+ orgs. MOVEit — hit 2,700+ organizations.
Top-tier vendor reviews on annual cadence. Critical vendor list maintained. Contractual security minimums updated [DATE]. SBOMs requested from top vendors.
Up from [Y]% last quarter. Faster reports = smaller incidents.
[X] hours, down from [Y]. Below industry median of [Z].
No material cyber events this quarter. Multiple near-misses contained.
[1-sentence narrative about the quarter — what changed, what improved, what investment paid off.]
| Investment area | This year | Why |
|---|---|---|
| Identity (passkeys, IdP) | [$X] | Highest ROI control; eliminates phishing payload |
| Cloud posture / CSPM | [$X] | Catch misconfigurations before they expose data |
| Awareness program | [$X] | Modern, AI-aware, role-based — [N] employees |
| Third-party risk tooling | [$X] | Continuous vendor monitoring; replaces manual assessments |
| IR readiness / tabletops | [$X] | Practiced response is the difference between hours and weeks |
| [Other] | [$X] | [Reason] |
Most cyber budget waste comes from buying tools without addressing the root cause: identity, third-party, and human factors. We're investing where the incidents actually start.
Cyber events are increasingly the subject of derivative lawsuits naming directors personally. Recent examples: SolarWinds CISO (SEC charges), Uber (CISO conviction), and a growing list of state AG actions.
What protects the board: documented cyber oversight, reasonable cybersecurity investment, and demonstrable board engagement. This quarterly briefing is part of that record.
Ask: [Approve $X for Y]
Why: [One sentence]
Outcome if approved: [Measurable result]
Outcome if not: [What risk persists]
Ask: [Accept residual risk on X]
Why: [Cost of mitigation vs. risk]
What we'll do: [Compensating control]
Re-evaluate when: [Trigger]
Ask: [Approve the updated [POLICY]]
Why: [Reason — regulatory, contractual, risk-driven]
Owner: [Who'll operate this]
Effective: [Date]
Boards sometimes mistake my optimism for confidence. Here's what I genuinely worry about — so you know I'm being straight with you.
If we get hit by a major incident in the next 12 months, my best guess is it starts here. That's why we're investing where we are.
Common questions I'm ready to go deeper on:
Full Q&A prep covering 24 anticipated board questions is in the kit, in 04-Q-And-A-Prep.md.