New Research: The Confidence Gap Between CISOs and Their Boards Is Real, and It's Measurable
Follow us
Pulse Security AI calls for boards and security leaders to define cyber risk appetite in new report: The CISO-Board Communication Gap
Boards of directors believe they understand their company's security posture and what it means for the business. The security leaders presenting to them are far less sure. Only 12.5% of security leaders are very confident their board walks away understanding the true state of the program, and 55% of boards have never formally defined what cyber risk the company is willing to accept.
Pulse Security AI unveiled these findings today in The CISO-Board Communication Gap, a research report drawing on more than 80 senior practitioners, examining how security leaders report to their boards and what gets lost between the two.
"For a decade, the industry has told security leaders to communicate better with the board," said Mike Armistead, CEO and co-founder of Pulse Security AI. "Our data says the problem is upstream of that. You cannot report status against a baseline that was never set."
Here are the top five insights from the research:
- The Confidence Gap is Measurable. Just 12.5% of security leaders are very confident their board accurately understands the program after a presentation. 41% land at somewhat confident, and 38% are neutral or mixed. Both sides leave the room, and the cycle continues largely unchanged.
- The Baseline Was Never Set. 55% of boards have never formally defined cyber risk appetite, and another 27% define it only qualitatively. Without an agreed baseline, external noise fills the vacuum: roughly 70% of security leaders say board members bring third-party ratings and press coverage into the room, and 42% had to defend a commercial security score in the past 12 months.
- Board Prep is an Operational Tax. 71% of security leaders spend 10 or more hours preparing for each board cycle, one to two full working days every quarter, and 39% involve four or more contributors per presentation. The top time sinks: building slides, gathering data across tools, and translating findings into business language.
- Governance Runs on Instinct, Not Instrumentation. Half of boards made no explicit decision to accept, mitigate, or transfer cyber risk in the past year. 48% of security leaders have no private executive session access, 23% have no predefined threshold for board-level escalation, and 33% say their own legal exposure shapes what they tell the board.
- Trust is Recoverable, and a Breach Shouldn’t Be the Trigger. 53% of security leaders say board trust increased after a material security incident. A real event forces a shared, concrete understanding of risk that quarterly updates rarely produce. The report details five practices, drawn from leaders with the highest board trust, for creating that alignment.
Armistead continues, “You cannot assemble a clear picture of the business when the underlying information lives in a dozen disconnected places. Security leaders have earned the room. What they need now is the operating layer underneath it."
Download the full report, The CISO-Board Communication Gap: https://pulsesecurity.ai/newsroom/ciso-board-communication-gap/
Methodology
Findings draw on a 42-respondent survey of security leaders and corporate directors, more than 20 in-depth interviews with sitting and former CISOs, and two moderated workshops with roughly 22 CISOs. Seventy percent of survey respondents are CISOs or heads of security. Industries represented include technology and software (34%), financial services (25%), healthcare and life sciences (9%), and manufacturing (9%). These are not nationally representative statistics. Their value is depth and seniority: participants are the people who sit in audit committee meetings. Percentages are computed on those answering each question. A small corporate-director sub-sample is treated as directional only. Quotes are anonymized at participants' request.
About Pulse Security AI
Pulse Security AI is redefining how cybersecurity programs are run. Pulse is an operational management platform for security leaders, where security professionals and AI agents work together to execute procedures, capture decisions, and deliver real-time program visibility without the manual overhead. The result is a security organization that runs faster, costs less, and gives leaders clear confidence in where their program stands.
Contact
Carmen Angela Harris
Pulse Security