Global cyber security board reporting research results are in. How to ensure your reporting makes the grade?

The 2025 publication, "Cybersecurity Board Reporting: The Board’s Perspective," revealed that the relationship between Boards and management on cyber security matters is often not as strong as it should be. According to the research, only 31% of surveyed Board members rated the cyber security reporting they receive as acceptable or good. 

This finding prompted several important questions: Why is this the case? What causes it? And more importantly, how can it be improved? To explore this, the team conducted interviews with Board members from 67 organisations across Belgium, Switzerland, and Australia. Notably, 64% were listed companies, with an average market capitalisation approaching $20 billion. 

In addition to these interviews, they analysed dozens of sanitised, real-world cyber security Board reports, uncovering insightful data points, trends, and unique recommendations. The report offered practical observations and guidance for Boards, executive teams, and cybersecurity leaders. It highlighted what Boards are doing well, and where management, particularly CIOs and CISOs, can improve the quality of their reporting across key areas like risk, strategy, and operational status. Importantly, the report also introduced a Cybersecurity Board Reporting Framework, a practical tool designed to foster a "warm handshake" between Boards and management. 

The framework clearly lays out the steps, processes, and topics that need alignment to ensure more effective, informed conversations at Board level. The plans to extend the research to cover all 5 continents globally is well under way and interviews have already commenced. The 2026 report will also cover the perspective of CISO's and Cyber Executives to further assist in uplifting reporting. 

The results of the 2026 research will be finalised in early September in time for the AISA conference. It would be great to share the outcomes and better practices as identified by the research. As an added feature I am in discussion with ASIA executives on the potential to obtain an AISA subset of the data and share the results compared to the rest of Australia and globally. This material provides specific and actionable guidance on improvements that can be made to Board reporting and feedback on 2025 presentations has been extremely positive.