Cybersecurity

NEW WHITEPAPER: How Are Today’s Top CISOs Briefing Their Boards?

September 18, 2025

Security leaders are under increasing pressure to clearly communicate risk, resilience, and readiness to their Boards of Directors. But what are top CISOs actually saying, and showing, when it matters most? In this report, Team8’s CISO Village asked a select group of security leaders from Atlassian, OpenLane, PennyMac, Justworks, Vector, Yageo and more to share their personal approaches to board briefings. The insights go far beyond slide decks and might surprise you.

Effective board reporting may start with relationships but ends with tailored, data-driven storytelling and this varies across organizations. This white paper offers a detailed look at how today’s most respected CISOs are navigating this high-stakes responsibility.

Key Takeaways:

Slide decks remain dominant, but narrative is rising.
A growing number of CISOs are now pairing traditional board slides with written executive summaries. Some go even further, offering dedicated portals or Confluence pages to reinforce the “so what” behind the data.
Four slides nearly every board sees (across the board: Pardon the Pun).
- Security Initiative Progress (Gantt charts tied to risk)
- Security Posture Overviews (radar charts showing maturity gaps)
- Compliance Status (covering SOX, GDPR, HIPAA, EU AI Act, etc.)
- Risk Assessments (external evaluations or red team exercises).
Metrics that map to outcomes.
Phishing simulations, patch remediation timelines, and audit results are most commonly presented. The key shift: tying these KPIs directly to business impact, like regulatory exposure or revenue protection.
Security as a business enabler.
CISOs are reframing cybersecurity from a cost center to a driver of trust and growth, using metrics like “security spend per dollar of customer revenue” or tracking revenue tied to specific certifications.
Board education is part of the job.
CISOs are dedicating time in briefings to walk boards through parts of NIST or CIS frameworks, using these to both educate and benchmark organizational progress.