The Board Meeting Looks Fine. The Governance Beneath It Is Broken.

New research released at Black Hat exposes a structural crisis in CISO-board relationships — and finds that better presentations won't fix it.

Security leaders have mastered the quarterly board presentation. They show up prepared, speak the language of business risk, and deliver polished decks on schedule. Yet new research released this week at Black Hat reveals a troubling paradox: boards are understanding less than ever — and almost no one in the room realizes it.

The findings come from Pulse Security AI's CISO–Board Communication Gap report, published August 6, 2026. Drawing on a 42-respondent survey, more than 20 in-depth interviews with sitting and former CISOs, and two moderated workshops with roughly 22 security executives — more than 80 senior practitioners in total — the report offers one of the most granular examinations of CISO-board dynamics published to date.

Its central conclusion is unambiguous: the governance infrastructure underneath the board meeting is broken, and no amount of communication coaching will fix it.

---

The Confidence Gap No One Is Talking About

The report's most striking number is this: only 12.5% of security leaders are "very confident" their board accurately understands the true state of the security program after a presentation. Another 41% are "somewhat confident." Nearly 38% are neutral or mixed.

Read those figures in reverse and the picture sharpens considerably. Nearly nine in ten CISOs walk out of their board presentation without strong confidence that the people responsible for cybersecurity governance just received an accurate picture of what is happening.

"Boards think they understand their security posture and what it means for the business," the report states. "The CISOs presenting to them aren't so sure — and the cycle continues largely unchanged."

The industry's standard prescription for this problem has long been better communication: sharper storytelling, fewer technical terms, more business-oriented framing. The Pulse Security AI data challenges that diagnosis directly. Survey respondents said they wanted simpler data delivery, better frameworks, and clearer context. They did not ask for coaching.

"For a decade, the industry has told security leaders to communicate better with the board," said Mike Armistead, CEO and co-founder of Pulse Security AI. "Our data says the problem is upstream of that. You cannot report status against a baseline that was never set."

This structural disconnect sits at the heart of what practitioners working across enterprise cybersecurity governance frameworks and board accountability have flagged as one of the most persistent and underexamined failures in modern security leadership.

---

A Baseline That Was Never Set

The Risk Appetite Vacuum

That upstream problem has a specific shape. Fifty-five percent of boards have never formally defined their organization's cyber risk appetite. Another 27% have defined it only qualitatively. That means just 18% of boards have established anything resembling a quantitative baseline — and only 16% successfully use a quantified risk model such as FAIR. A mere 3% present dollar-figure risk estimates.

Without an agreed baseline the CISO has no fixed reference point. "Good" and "bad" become relative terms with no anchor. And when organizations leave that vacuum unfilled, something else moves in to fill it.

Understanding how risk appetite connects to broader organizational accountability is essential context here. The disciplines covered within governance, risk, and compliance strategy for security teams make clear that without a defined tolerance for cyber risk, reporting becomes performative rather than actionable — a status update dressed as governance.

External Noise and the Vendor Score Problem

Roughly 70% of security leaders report that board members bring external information into the room: third-party security ratings, press coverage of peer incidents, and findings from vendors with a direct financial interest in the board's conclusions. Forty-two percent of CISOs have had to defend a commercial security score in a board meeting in the past 12 months.

One CISO quoted in the report was direct about the absurdity of that dynamic: "That score I have to defend is decided by two product managers — usually junior — who have never held a serious security role."

This external noise problem is not incidental. When no internal baseline exists, boards default to whatever comparative signals are available — regardless of whether those signals are meaningful, contextually appropriate, or commercially motivated.

Governance Gaps With Real Consequences

The governance implications extend further:

• 50% of boards made no explicit decision to accept, mitigate, or transfer cyber risk in the past year
• Nearly a quarter of security leaders have no predefined threshold for board-level escalation
• 48% have no private executive-session access to the board or audit committee — meaning nearly half of CISOs have no forum in which to raise concerns that cannot be voiced in a full meeting

Personal legal exposure adds another layer of distortion. Thirty-three percent of security leaders say their own liability concerns — intensified by SEC disclosure enforcement following events like SolarWinds — influence what they tell the board and how they say it. One in three CISOs is making editorial decisions about board communication based partly on personal legal risk rather than purely on what the board needs to know.

That dynamic has accelerated since the SEC formalized its cybersecurity disclosure rules in 2023. For further context on how regulatory pressure is reshaping security reporting obligations, the SEC's cybersecurity disclosure guidance provides useful grounding on what material incident reporting now legally requires.

---

The Operating Layer Underneath the Boardroom

Board Prep Is Consuming the Security Function

The structural problems don't stop at the boardroom door. Seventy-one percent of security leaders spend 10 or more hours preparing for each board or audit-committee presentation. Twenty-nine percent spend between 21 and 40 hours. Thirty-nine percent involve four or more contributors per preparation cycle.

That time is not spent on narrative craft. It is spent gathering data from disconnected security tools, building visualizations, and manually translating technical findings into business language — a process one CISO described plainly: "Every hour spent pulling, analyzing, and translating data from a dozen disconnected tools is an hour not spent on actual security work."

The preparation burden and the confidence gap are structurally linked. When board metrics are assembled by hand from disparate sources every quarter rather than drawn from a maintained single source of truth, the resulting presentation is less likely to convey a coherent picture of business risk — regardless of how skilled the presenter is.

This is also where the conversation about building an effective information security governance structure becomes directly operational. Governance isn't only about what gets reported to the board — it's about the data infrastructure, accountability mechanisms, and decision-making processes that make accurate reporting possible in the first place.

When Crisis Creates Clarity

There is, notably, a hopeful signal embedded in the data. Among security leaders who have navigated a material security incident, 53% report that board trust in the security team increased afterward. The report attributes this to a dynamic that mirrors the plot of nearly every crisis scenario: a real event forces a concrete, shared understanding of risk that quarterly presentations rarely achieve.

A corporate director at a Fortune 100 company made the point plainly: "Performing a tabletop exercise with our security team established their credibility in a way a presentation never could."

This finding carries a practical implication that organizations should not ignore. If a live incident is the most reliable mechanism for building board-level security credibility, that is a signal to deliberately engineer the conditions that produce that shared understanding — before an incident forces the issue. Tabletop exercises, pre-agreed escalation thresholds, and joint risk scenario reviews are all mechanisms that replicate the clarity of crisis without requiring one.

Five Practices That Change the Dynamic

The research identifies five practices common to leaders who reported the highest board trust and the lowest preparation burden:

1. Define risk appetite before reporting against it — establish the baseline that makes every subsequent presentation accountable rather than descriptive
2. Lead with business consequence rather than control inventory — boards govern risk, not technology; frame accordingly
3. Automate data aggregation to eliminate the quarterly fire drill that consumes security team capacity
4. Agree on escalation thresholds in advance — remove ambiguity about what triggers a board-level conversation
5. Secure a recurring private session with the board or audit committee — create the forum where candid concerns can actually be raised

Armistead framed the challenge in operational terms: "You cannot assemble a clear picture of the business when the underlying information lives in a dozen disconnected places. Security leaders have earned the room. What they need now is the operating layer underneath it."

---

What This Means for You

If you sit on a board or audit committee, the absence of a defined cyber risk appetite is not a neutral omission — it is the primary condition that makes meaningful security governance impossible. Setting even a qualitative baseline transforms every subsequent CISO presentation from a status briefing into an accountable report.

If you are a CISO or security leader, the research suggests that advocating for structural change — a defined risk appetite, automated data aggregation, and a standing private board session — will deliver more measurable improvement than refining your presentation skills.

If you lead a mid-market or smaller organization, the external-noise problem is disproportionately acute for you: lean security functions are least equipped to push back against vendor scores and breach headlines, and most exposed to the governance distortions they create. Establishing even informal escalation thresholds and risk appetite definitions before the next board meeting is an immediate and low-cost step.