CISOs and Boards: New Research Reveals Measurable Confidence Gap
New Research: The Confidence Gap Between CISOs and Their Boards Is Real, and It’s Measurable A recent study highlights a significant disparity in perception between chief information security officers (CISOs) and corporate boards regarding cybersecurity preparedness.
A recent study highlights a significant disparity in perception between chief information security officers (CISOs) and corporate boards regarding cybersecurity preparedness. The findings, released by Pulse Security AI, reveal that only 12.5% of security leaders feel confident their boards fully grasp the state of their organization’s cybersecurity program. Meanwhile, 55% of board members have not established a formal definition for the company’s acceptable level of cyber risk. The research, titled *The CISO-Board Communication Gap*, analyzed input from over 80 senior cybersecurity professionals and corporate directors. It underscores systemic challenges in aligning technical risk assessments with board-level decision-making.
Key Findings from the Study
Measurable Confidence Gap
Security leaders report a stark lack of assurance that their boards comprehend the true state of cybersecurity efforts. Only 12.5% of respondents expressed high confidence in their board’s understanding, while 41% were somewhat confident and 38% remained neutral or uncertain. This disconnect persists despite repeated efforts to improve communication.
Undefined Risk Appetite
Fifty-five percent of boards have not formally defined their cyber risk tolerance, with an additional 27% relying on qualitative assessments. This absence of clarity leads to reliance on external metrics, such as third-party security ratings and media reports. Nearly 70% of security professionals noted that board members frequently reference these external sources during discussions, and 42% reported defending commercial security scores within the past year.
Operational Burden of Board Preparation
Security leaders dedicate substantial time to preparing for board presentations. Seventy-one percent spend 10 or more hours per cycle, equivalent to one to two full workdays quarterly. The process involves coordinating input from four or more contributors, with significant time spent on data aggregation, slide creation, and translating technical findings into business terms.
Governance Based on Instinct, Not Process
Half of boards made no explicit decisions on risk acceptance, mitigation, or transfer in the previous year. Forty-eight percent of security leaders lack access to private executive sessions, and 23% have no predefined thresholds for escalating issues to the board. Additionally, 33% of respondents indicated that legal considerations influence the information shared with board members.
Trust Recovery Post-Breach
Fifty-three percent of security leaders reported increased board trust following a material security incident. Armistead noted that breaches should not be the catalyst for improved collaboration. “Security professionals have earned their place at the table,” he said. “What they need is a structured framework to ensure clarity and consistency in reporting.”
The study’s methodology involved a survey of 42 security leaders and corporate directors, along with 20 in-depth interviews with current and former CISOs and two moderated workshops featuring 22 CISOs. Pulse Security AI, the organization behind the research, offers an operational management platform designed to streamline cybersecurity workflows. The tool integrates AI-driven insights with human expertise to enhance decision-making, reduce manual overhead, and provide real-time visibility into security programs.
The findings underscore the urgent need for boards and security teams to establish clear risk parameters and standardized communication protocols. Without such measures, the gap between technical execution and strategic oversight will continue to widen, leaving organizations vulnerable to evolving threats.
About Author
English