The podcast and the article are brought to you by The Better Boards Podcast Series.
Cybersecurity is a top risk for organisations, yet many boards feel poorly informed. At the same time, executive teams feel they are reporting into a void. The reasons behind this ongoing disconnect bear close examination.
In this podcast, Dr Sabine Dembkowski, Founder and Managing Partner of Better Boards, is joined by Dr Maya Bundt. Maya is a board Director and cyber risk expert based in Zurich. She serves as a Non-Executive Director on the boards of listed Swiss companies and is President of the Steering Committee for Switzerland’s National Cyber Strategy. She also co-leads the International Cybersecurity Board Reporting Study and Framework, teaches cybersecurity, and serves on the boards of several universities.
It’s a cold handshake.
For Maya, a warm handshake happens when cyber is on the board meeting agenda. The CISO (or other IT representative) comes to talk with the board. The board hears, understands, and can actively discuss the cyber issues and cyber risks. That’s what warmth means.
Unfortunately, most often it’s a cold handshake. When Maya’s group interviewed 67 board members across three countries in 2025, only 31% believed they received the right information to assess risks and make informed decisions. The 2026 survey results are trending even lower, with only 23% comfortable with their data.
Boards and management speak a different language.
To Maya, a big part of the problem is structural. There is no standard format for what a good cyber report should look like or what board members should see. Without that infrastructure in place, directors are left feeling uneasy.
There has to be someone on the board who knows a little bit more and can drive the discussion a little bit further than the basics.
Maya strongly believes that a best practice for boards is to have someone on the board who can lead cybersecurity discussions from an informed position. After all, boards are expected to be experts in other critical areas like finance, so why not cybersecurity as well? It’s a real gap, and therefore a real opportunity for many firms to build a competitive advantage.
Maya also recommends that organisations do regular training with their boards. Outside speakers and presentations are helpful. Crisis simulations can also help clarify roles, responsibilities, and responses needed, keeping board members current on governance procedures and realistic risk scenarios.
A good report starts with the risk and risk appetite.
Beyond training, the structure of the reports matters for boards. Maya feels a good report starts with risk levels and risk appetites. This should also be put in context of world events, the industry, and the firm’s position. Budget, key regulations, operational frameworks, the present-day situation, and a forward outlook are also recommended for a good report.
Between trainings and reports, boards should also work to build a strong relationship with their CISO or cyber risk team lead. A 10-minute presentation during a meeting is not enough time to build the trust and rapport needed to shepherd an organisation safely through cyber risk. Boards must make an effort to build a two-way, plain-language conversation grounded in trust to keep things aligned and ensure warm handshakes at meetings and during any crisis events.
The three top takeaways from our conversation are:
- A warm handshake has two halves: governance and reporting.
- The problem is universal, and it is not about budget.
- Warming the handshake is a leadership task for the board, not something to delegate to the technology function.
Join The Better Boards Community
We’d love to get to know you! If you’d like to become part of the Better Boards community, discover our unique approach, and explore ways to work with us or share your ideas on The Better Boards Podcast series, drop us a line at [email protected].
