The CISO and the Board: partners against cyber crime
- John R Childress
- Feb 15, 2025
- 3 min read
Updated: Jan 20
A strong cyber security programme is not just a technology problem.
It’s an enterprise risk problem.
This insight piece explains why outcomes improve when CISOs and boards work as true partners, and what each side can do to make governance practical and effective.
Why the CISO–Board partnership matters
Cyber risk drops when oversight is real, not symbolic.
Cyber security can’t be guaranteed, but the risk of breaches drops considerably when the CISO has a strong working relationship with the executive team and, most importantly, the board. The article points to survey findings suggesting financial losses are lower when the security leader reports to the board.
If you want cyber security culture to “stick”, this partnership is one of the highest-leverage drivers because it shapes priorities, funding decisions, and the signals leaders send across the organisation. (See: cyber-security-culture)
What the CISO should do differently
Start with business priorities, not technical detail.
Boards focus on financial and operational performance, brand value, investor confidence, and risk appetite. A CISO who frames cyber security through those lenses is more likely to earn trust and support.
Practical moves from the article include: aligning cyber initiatives and budgets to strategy, quantifying cost avoidance and return on investment, and using visual dashboards that are forward-looking rather than retrospective. In short, help the board govern future risk, not review last quarter.
Make cyber risk governable
Use leading indicators, not lagging incident narratives.
One of the strongest points in the article is that boards are often looking at information that is already out of date. What boards need is clearer, forward-looking oversight that anticipates risk.
This is where culture becomes measurable: when you track the conditions shaping decisions and behaviour before an incident occurs. A board-ready view of leading indicators makes it easier to prioritise and invest in the changes that reduce human risk at source.
Integration beats silos
Cyber security is a team sport, not a security team issue.
The article is clear that poor cross-functional communication and a lack of cooperation create unnecessary risk. The CISO’s role is not only to run controls, but to ensure functions understand their individual and collective roles in cyber-safe work and breach response.
A simple but powerful closing question after board updates is: “How can I better support you?” It changes the tone from reporting to partnership, and it often surfaces the organisational friction that drives workarounds and weakens secure practice.
What boards should expect of themselves
A one-way partnership doesn’t work.
The article argues that boards should build baseline cyber understanding and actively demand an enterprise approach. Cyber security is too big a job for any one function, so boards need to ensure the CEO supports functional heads to work with the CISO.
It also makes an explicit link between cyber breaches and human factors. Boards are increasingly being asked to provide oversight of corporate culture because many breaches have a “human fingerprint”. Culture oversight isn’t an HR topic. It’s a governance responsibility.
An important partnership
Strong governance means agreeing what “good” looks like and acting on it.
This piece closes with a simple message: the board–CISO relationship is in everyone’s best interests, and board chairs should treat it as a priority.
“Alone we can do so little; together we can do so much.” — Helen Keller
If you want to operationalise this partnership, focus on the drivers that shape everyday cyber decisions: leadership signals, incentives, policy design, tool usability, time pressure, peer norms, supervision, reporting climate, and third-party practices. This is the level where culture becomes a practical risk control.
If you’d like to explore how PYXIS supports that kind of board-ready oversight, book a demo.
Key topics covered in this article
Why the CISO–Board relationship is central to cyber resilience
How CISOs can communicate cyber risk in business terms
ROI, dashboards, and forward-looking board oversight
Breaking down silos and building enterprise ownership of cyber safety
The board’s role in capability-building and culture oversight
Why culture and employee engagement affect cyber security outcomes
About PYXIS Culture Technologies
PYXIS Culture Technologies helps organizations understand and improve the cultural drivers of performance, safety, and cyber resilience.
By combining deep research, operational experience, and advanced culture analytics, we help organizations close the gap between cyber strategy and everyday behaviour.
Our approach is effective:
We treat culture as a systemic business issue, not an HR initiative.
We identify key internal business practices that create cyber security risks and provide effective solutions you can immediately implement.
We link your cybersecurity culture to business financial metrics, showing a clear ROI for strengthening your cybersecurity culture.
Connecting the dots
See how PYXIS models What-If scenarios to prioritise the fixes that move your numbers.