Risky business: Creating board metrics that make a difference

Our presentation begins by addressing a critical and often overlooked issue in enterprise cybersecurity: the persistent misalignment between board-level metrics and the actual financial and operational risks posed by cyber threats. Despite unprecedented investment in cybersecurity, organisations (particularly within the financial sector), continue to struggle with effectively communicating cyber risk to their boards. The opening segment situates this problem in the broader context of cyber and technology governance, highlighting how traditional security metrics, such as threat counts or compliance checklists, fail to provide meaningful insight into the organisation’s strategic risk posture. These measures often reflect activity rather than impact, and their technical framing obscures their significance to board members tasked with making high-stakes investment and oversight decisions.

The presentation then explores the governance challenge in depth, drawing from our research findings to reveal how cybersecurity reporting frequently suffers from a principal–agent dynamic. Security professionals tend to focus on technical achievements and operational coverage, while boards require metrics that clearly express potential consequences in financial, reputational, and regulatory terms. This disconnect undermines effective decision-making and creates the illusion of preparedness, even in the face of substantial vulnerabilities. To bridge this divide, the presentation introduces a suite of reconceptualised board metrics, grounded in economic reasoning and material risk. Central to this is the concept of mission-critical asset classification, an approach that links IT assets directly to business services, regulatory functions, and enterprise value. This classification framework serves as the foundation for prioritised investment and risk quantification.

Next, we introduce a visual and analytical tool for board-level risk communication. By explicitly linking threats, controls, and consequences, this method helps frame cybersecurity in terms of causal relationships and residual risk. It offers boards a structured yet accessible way to understand how specific cyber threats can disrupt business functions, and how well current controls mitigate that risk. The presentation emphasises that metrics must be impact-based, scenario-driven, and periodically reassessed to remain relevant. For example, rather than measuring the number of patches applied, a more informative metric might be the percentage of critical business assets that are demonstrably resilient to the top five known threat vectors.

In its final sections, the presentation addresses the role of the board itself in fostering effective cybersecurity governance. It argues for a shift from passive oversight to active engagement by offering a practical roadmap for implementing these reforms, beginning with auditing existing metrics, followed by adopting a mission-critical asset model, and finally embedding actionable insights into regular board reporting. The session closes with a call to action: in an era where cyber and technology risk increasingly shape enterprise value, only metrics that make a strategic difference can truly justify their place at the board table.