Boards and CISOs Fall Short on Cyber Risk Discussions Amid Rising Threats

Cybersecurity discussions between Chief Information Security Officers (CISOs) and enterprise boards are falling short, with interactions limited to just 30 minutes per quarter. A recent report from IANS, Artico Search, and The CAP Group highlights the inadequacy of these conversations, which lack depth and fail to address emerging threats, particularly those posed by AI and other technologies.

## What Happened
The study reveals that CISO-board interactions are often superficial, with boards merely "listening" rather than actively participating in discussions. This lack of engagement is concerning, given the increasing sophistication of cyber threats. For instance, North Korean Advanced Persistent Threats (APTs) have been using AI to enhance IT worker scams, making it essential for boards to be more proactive in addressing these risks.

## Why It Matters
The consequences of inadequate cybersecurity strategies can be severe, with data breaches and cyberattacks resulting in significant financial losses and reputational damage. Effective communication and collaboration between CISOs and boards are crucial in developing robust cybersecurity measures. However, the current state of CISO-board interactions is hindering this process.

## What Experts Say
"The industry is still maturing, and 'good' is a moving target," said Nick Kakolowski, senior director for CISO research at IANS. "CISOs and boards are still developing a shared vocabulary to contextualize and understand the long-term business implications of cyber issues."

## Key Numbers
- 30 minutes: The average duration of CISO-board interactions per quarter
- 30%: The percentage of boards describing their relationship with CISOs as "strong and collaborative"
- 35%: The percentage of boards describing their relationship with CISOs as "adequate and functional"
- 24%: The percentage of boards saying their relationship with CISOs needs improvement

## Background
The use of AI in cyberattacks is becoming increasingly prevalent, with North Korean APTs leveraging AI tools to enhance IT worker scams. These sophisticated threats require a more proactive and collaborative approach from CISOs and boards.

## Key Facts
- Who: CISOs and enterprise boards
- What: Inadequate cybersecurity discussions and lack of shared vocabulary
- When: Ongoing, with growing cyber threats
- Where: Global, with North Korean APTs posing a significant threat
- Impact: Increased risk of data breaches and cyberattacks

## What Comes Next
As cyber threats continue to evolve, it is essential for CISOs and boards to prioritize effective communication and collaboration. This includes developing a shared vocabulary and engaging in more in-depth discussions to address emerging risks and develop robust cybersecurity strategies.