Beyond Good Intentions: How Should a Board Oversee Ethics?

Boards and management should connect smoothly on cyber risk, but often don’t. The 2026 Cybersecurity Board Reporting Study reveals what is happening in boardrooms and, more importantly, what boards can change to get better information and achieve better outcomes.

In this episode of The Better Boards Podcast Series, Dr Sabine Dembkowski, Founder and Managing Partner of Better Boards, the provider of board evaluation and board development services, speaks with Dr Maya Bundt and Chris Verdonck about why so many boards still feel under-informed on cyber and what the highest-performing boards do differently.

Maya is a Zurich-based board director and cyber-risk expert. She serves on listed Swiss boards, chairs the Steering Committee of the Swiss National Cyber Strategy, and co-founded Cybersecurity Board Reporting (CSBR).

Chris is a retired Deloitte Partner and experienced board adviser. He works with boards and executive teams on digital transformation, cybersecurity, AI, technology risk, and organisational resilience, and co-founded CSBR.

“Less than a quarter of directors think they have the information they need.”

This year’s study included 78 board directors across 13 countries, 35 security executives, and a review of 11 real board documents.

One finding stands out: only 24% of directors believe they receive the information they need to fulfil their responsibilities on cyber risk.

That is not simply a reporting problem. It is a governance problem with real consequences for decision-making, oversight, and organisational resilience.

“You don’t have to change who you are. You have to change what you do.”

Maya and Chris explain that board size, headcount, listed status, and regulatory intensity did not determine whether directors felt well informed.

What mattered was behaviour.

Boards that actively discussed and worked through severe yet plausible cyber scenarios rated the quality of their cyber reporting almost twice as highly as boards that did not. Perceived value was also greater when reporting came through a CISO, risk function, or cyber committee — rather than being treated primarily as an audit matter.

In other words, better cyber oversight is not about becoming a technical expert. It is about creating the right conditions for meaningful boardroom dialogue.

“We have a standard report developed as part of our new publication. It has all the content areas that are needed.”

Chris and Maya identify several factors that improve the quality of cyber reporting. The most fundamental is the organisation’s digital profile.

It starts with three questions:

• What does the business stand to lose?
• How intensively is it regulated?
• What would cybersecurity excellence be worth commercially?

Together, these questions determine the level of digital reporting and digital governance an organisation needs. Only when the digital profile and governance level align can boards and management achieve what Maya and Chris call a “warm handshake”.

Beyond the digital profile, a strong cyber report covers six content areas: context, strategy, risk, risk governance, status, and outlook.

Another practical step is appointing a central point person to gather the information. Boards often receive cyber updates from multiple sources, in different formats, and at different levels of detail. A coordinator can speak with both sides, compare perspectives, resolve inconsistencies, and ensure the board receives genuinely useful information.

 

The top three takeaways from our conversation for effective boards are:

• This is not structural. It is about choices. Better cyber oversight does not depend on board size or sector — it depends on what boards choose to do.
• Make someone responsible for assembling the information. A clear point of coordination turns fragmented updates into insight the board can use.
• End every cyber discussion with a decision. It can be a simple decision, but it should be a decision creating momentum, accountability, and follow-through.

 

Come Join the Better Boards Community

We’d love to get to know you! If you’d like to become part of the Better Boards community, discover our unique approach, and explore ways to work with us or share your ideas on The Better Boards Podcast Series, drop us a line at info@better-boards.com

Remember to subscribe and never miss an episode of the Better Boards Podcast Series. It’s available on Apple, Spotify, or Google.

 

To find out how you can participate in the Better Boards Podcast Series or for more information on Better Boards’ solutions, please email us at info@better-boards.com.