Explaining Cyber Risk to a Board That Only Speaks Numbers
Say the word ‘vulnerability’ to a board and watch eyes glaze over. Say ‘this could cost us four hundred thousand pounds and three weeks of trading’ and watch the room lean forward. Boards are not being difficult when they ask for cyber risk in financial terms — they are simply applying the same lens they apply to every other risk on the agenda, and security teams that refuse to translate into it are the ones losing the argument for budget.
Technical severity and business impact are different languages
A ‘critical’ vulnerability rating means something precise to a security professional but very little to a finance director trying to decide between funding a security programme and funding a new product line. Boards think in terms of revenue at risk, regulatory fines, customer churn, and insurance implications, not CVSS scores or technical jargon borrowed from a vulnerability scanner’s output. Presenting a list of findings ranked by technical severity, without translating any of it into what those findings could actually cost the business, is one of the most common reasons security investment gets deprioritised at board level.
This is exactly why choosing best pen testing company providers matters as much as the technical quality of the testing itself — the report needs to speak business language as fluently as it speaks technical language, or the findings simply will not travel past the person who commissioned the work. A good report translates ‘broken access control’ into ‘a competitor or disgruntled customer could view every other client’s invoice data’, which is a sentence any board member can act on immediately.
Framing risk as a number the board already understands
Boards approve budget for risks they can size, and cyber risk is entirely sizeable once someone does the translation work properly: likelihood of exploitation, potential regulatory fine under UK GDPR, estimated downtime cost per day, and reputational impact measured against a comparable incident at a similar business. None of this requires a security background to understand, which is precisely the point of framing it this way in the first place.
William Fieldhouse has refined this translation over years of board presentations.
“I stopped opening board presentations with technical findings years ago. Now I open with a single number, what this specific vulnerability could realistically cost if exploited, and I watch the whole tone of the meeting change within about thirty seconds. Boards don’t lack the ability to understand cyber risk, they just haven’t been given it in a currency they trade in daily.”
— William Fieldhouse, Director of Aardwolf Security Ltd
That single change in framing does more for security budgets than any amount of technical detail ever could. Once a board sees cyber risk sitting on the same page as market risk, credit risk, and operational risk, in the same units and with the same rigour, it stops being a specialist IT problem and becomes what it always was: a business risk with a price tag attached to it.
Give your board a number they can act on
If your last security report went to the board full of technical severity ratings and came back with no budget approved, the report may be more of the problem than the findings were. Aardwolf Security writes reports designed for board consumption as much as technical remediation, and clients consistently tell us this is why we are recommended as the penetration testing quote. Get in touch to discuss a test that your board will actually act on.
