Boards of directors believe they understand their company’s security posture and its business implications, but the security leaders presenting to them are far less confident. According to new research from Pulse Security AI, only 12.5% of security leaders are very confident that their board walks away with an accurate understanding of the program, and 55% of boards have never formally defined the level of cyber risk the company is willing to accept.
Pulse Security AI unveiled these findings today in The CISO-Board Communication Gap, a research report drawing on insights from more than 80 senior practitioners. The report examines how security leaders report to their boards and what gets lost in translation.
“For a decade, the industry has told security leaders to communicate better with the board,” said Mike Armistead, CEO and co-founder of Pulse Security AI. “Our data says the problem is upstream of that. You cannot report status against a baseline that was never set.”
Top Five Insights from the Research
1. The Confidence Gap is Measurable
Only 12.5% of security leaders are very confident their board accurately understands the program after a presentation. 41% land at somewhat confident, and 38% are neutral or mixed. Both sides leave the room, and the cycle continues largely unchanged.
2. The Baseline Was Never Set
55% of boards have never formally defined cyber risk appetite, and another 27% define it only qualitatively. Without an agreed baseline, external noise fills the vacuum: roughly 70% of security leaders say board members bring third-party ratings and press coverage into the room, and 42% had to defend a commercial security score in the past 12 months.
3. Board Prep is an Operational Tax
71% of security leaders spend 10 or more hours preparing for each board cycle—one to two full working days every quarter—and 39% involve four or more contributors per presentation. The top time sinks: building slides, gathering data across tools, and translating findings into business language.
4. Governance Runs on Instinct, Not Instrumentation
Half of boards made no explicit decision to accept, mitigate, or transfer cyber risk in the past year. 48% of security leaders have no private executive session access, 23% have no predefined threshold for board-level escalation, and 33% say their own legal exposure shapes what they tell the board.
5. Trust is Recoverable—and a Breach Shouldn’t Be the Trigger
53% of security leaders say board trust increased after a material security incident. A real event forces a shared, concrete understanding of risk that quarterly updates rarely produce. The report details five practices, drawn from leaders with the highest board trust, for creating that alignment.
Armistead continues, “You cannot assemble a clear picture of the business when the underlying information lives in a dozen disconnected places. Security leaders have earned the room. What they need now is the operating layer underneath it.”
The full report, The CISO-Board Communication Gap, is available for download at pulsesecurity.ai/newsroom/ciso-board-communication-gap/.
Methodology
Findings draw on a 42-respondent survey of security leaders and corporate directors, more than 20 in-depth interviews with sitting and former CISOs, and two moderated workshops with roughly 22 CISOs. Seventy percent of survey respondents are CISOs or heads of security. Industries represented include technology and software (34%), financial services (25%), healthcare and life sciences (9%), and manufacturing (9%). These are not nationally representative statistics. Their value is depth and seniority: participants are the people who sit in audit committee meetings. Percentages are computed on those answering each question. A small corporate-director sub-sample is treated as directional only. Quotes are anonymized at participants’ request.
About Pulse Security AI
Pulse Security AI is redefining how cybersecurity programs are run. Pulse is an operational management platform for security leaders, where security professionals and AI agents work together to execute procedures, capture decisions, and deliver real-time program visibility without the manual overhead. The result is a security organization that runs faster, costs less, and gives leaders clear confidence in where their program stands.
This is a paid press release published via CyberNewswire, a PR newswire syndication platform for cybersecurity companies.