Reporting
Board updates, executive reporting, metrics that matter to non-security leadership, and the one-page formats that get cyber funded without twenty follow-up questions.
What the Board Actually Wants in Q4 Security Updates
Q4 is the audit committee's sign-off quarter, and the year has to close on a number. Here is how to build a dollar figure that survives a skeptical director's follow-up questions, which parts of the standard security deck quietly get cut before the meeting, and the two slides that actually get read.
CFO Q4 Security Budgeting: What to Defend, What to Cut
The FY25 operating plan I wrote in September 2024 landed with a $10.7M cyber org's CFO because of the frame, not the number. Two budgets, ABC work classification, an honest "What We're Not Doing" section, and a leading-indicator KPI per line item so the bet stays defensible through Q1. For 2027, three new AI line items belong on every plan — headcount leverage, sub-processor governance, and deepfake resistance co-owned with finance.
PE Portco Security Governance: The Quarterly Board Packet the Fund Actually Needs
Kroll's 2026 PE cyber survey puts the average portco incident at $2.1M and ACA's 2026 benchmark finds half of PE portcos at elevated or high cyber risk. This is the three-slide quarterly packet that replaces the folder of heat maps and lets the fund answer the LP's aggregate-exposure question before an incident forces the answer.
The One-Page Cyber Risk Report Your Board Will Actually Read
Boards don't want 40 pages. They want one page, three numbers, and a budget decision. Here's the format that gets cyber funded without 20 follow-up questions.
Security Metrics and KPIs That Actually Matter
Your board doesn't care about your CVSS scores. Your CEO wants to know if you're secure. Here's how to measure and communicate security in terms that matter.
How to Quantify Cybersecurity Risk in Dollar Terms
Translate cybersecurity vulnerabilities into dollar-denominated risk exposure — the board-facing math behind defensible security ROI metrics.