Stop Reporting Vulnerabilities to the Board. Report Decisions.
I have sat through the board deck with 11,462 open vulnerabilities on the slide. Red, amber, a proud little downward arrow because last quarter it was 12,900. Everyone nodded. Nobody in that room could do a single thing with that number — including me. That slide is the clearest sign of a security program talking to itself.
A board does not govern vulnerabilities. It governs risk, capital, and consequence. When you put a raw count in front of directors, you hand them a number in a language they don’t speak and quietly ask them to trust that you’re on top of it. They will nod, because the alternative is admitting they don’t understand — and then you’ve taught them that security is noise to be managed, not a business function to be resourced.
They don’t need the work. They need the decision.
Most of what your team does is not a board decision. Patching the exposed server is not a board decision — it’s Tuesday. The board’s job is the small set of choices that trade money, time, or risk against each other at a level no one below them is allowed to settle. Your job is to surface exactly those, stripped of the 11,462. So I stopped reporting vulnerabilities. I started reporting decisions — three of them, every time.
The three decisions
The risk we are accepting, on purpose. Not the risk we missed — the risk we looked at, priced, and chose to live with. “The legacy claims platform can’t be patched without an 18-month migration. Here’s the exposure, here’s the compensating control, here’s what a breach of it plausibly costs. We are accepting this until FY28 — or we fund the migration now.” That is a board decision. Make them actually make it.
The bet we need funded. One material investment, framed as the risk it buys down and the risk you’ll still own after. Not “we need a new tool.” Rather: “Identity is our largest unmanaged exposure. This program cuts the blast radius of a stolen credential from the whole estate to one segment. Without it, one phished finance user is a company-wide incident.” Directors fund outcomes and consequences. They do not fund license counts.
What changed since last quarter. A new business line, a new regulation, an acquisition that just doubled your attack surface overnight. This is where you earn the room’s trust — by connecting the threat landscape to their strategy, not to CVE feeds.
Why this is harder — and the point
The pushback is always the same: if I don’t show the metrics, they’ll think I’m not doing anything. It’s backwards. The metrics are what make you look like a technician they can safely tune out. Decisions are what make you look like an executive they need in the room. The most dangerous position for a security leader is to be informative but not consequential — the person who reports the weather instead of the one who decides whether the flight takes off.
There’s a harder truth underneath. Reporting decisions means you can’t hide behind data. A vulnerability count is a place to point when things go wrong: “we flagged it, it was on the slide.” A decision has an owner and a date. When you tell the board “we are accepting this until FY28” and they say yes, you’ve done what most programs never do — you’ve made the organization own its risk out loud, together, with names attached.
Next board meeting, delete the vulnerability slide. Replace it with one sentence: here are the three risk decisions we need you to make today. Then be quiet and watch who leans in. If the room goes silent because they suddenly realize the risk is theirs too — good. That silence is the first time security actually reached the board.