There is a specific skill at the centre of cyber governance that does not get enough attention.
It is not technical expertise. It is not compliance knowledge. It is the ability to take a complex, technical risk environment and translate it into language that a CEO, CFO, or board member can act on.
This sounds straightforward. In practice, it is rare.
The Problem
Here is a sentence from a real security report presented to a board: 'Seventeen medium-severity CVEs identified in the external scan; patching cadence for non-critical systems is running at 14 days behind SLA.'
Every word in that sentence is accurate. None of it tells the board anything they can act on.
The translation required is not merely linguistic. It requires someone to answer the questions that sit underneath the technical data:
What does this mean for the business?
What could go wrong, and how badly?
What decision does the board need to make?
What is the cost of acting versus not acting?
A 14-day patching delay on non-critical systems might be irrelevant. Or it might represent an exploitable window for a threat actor who has already obtained initial access. The technical data does not tell you which — that requires judgement, context, and the ability to see the risk from a business perspective, not just a technical one.
The Consequences
The consequences of poor translation are not dramatic. They are structural.
When a board cannot interpret the security information it receives, it defaults to one of two positions: passive acceptance ('the IT team says we're fine') or reflexive investment ('buy more tools'). Neither is governance.
Passive acceptance means risks go unscrutinised. The board is not fulfilling its oversight function, not because it is negligent, but because it has not been given the information in a form that enables meaningful oversight.
Reflexive investment means security spend is driven by anxiety rather than analysis. It tends to result in overlapping capabilities, gaps in areas that were not visible enough to attract attention, and a growing list of technical controls that nobody at board level can confidently connect to the organisation's actual risk exposure.
Both positions leave the governance gap intact.
What This Is
Good translation in the context of cyber governance means two things.
First, every significant risk should be expressed in terms of business consequence, not technical description. Not 'a misconfigured cloud storage bucket exposed to the internet' but 'client data held in our project management system may have been accessible to unauthorised parties — here is what that means for our notification obligations and our client relationships.'
Second, board-level reporting should generate decisions, not just updates. Every risk report should end with a clear statement of what the board needs to decide, endorse, or note. Risk reports that simply inform without prompting action are not governance documents — they are comfort blankets.
The person capable of providing this translation needs to understand both sides of the conversation: the technical environment in enough depth to assess what is actually significant, and the business well enough to know what the consequences actually mean.
Why It Matters
This capability is what distinguishes a vCISO from other security functions.
An MSP brings deep operational capability. A compliance consultant brings framework knowledge. A pen tester brings technical attack expertise. A vCISO brings the specific combination of security depth and business fluency that enables the translation function — and the ongoing relationship with the board that makes that translation actionable.
It is, at its core, a leadership function. Not a technical one. The vCISO sits at the intersection of the security programme and the business, ensuring that the two speak to each other in a way that generates actual governance rather than reassuring noise.
How We Can Help
What distinguishes ITbuilder's vCISO service is that it was built around this translation function. The output is not a technical security programme. It is a board-level governance capability — specific, regular, and designed to give your leadership team the confidence and clarity to own cyber risk. The next two articles move from understanding the gap to making a decision: what a vCISO actually does, and how it compares commercially to a full-time hire.
Questions and Answers
What should a board actually be able to say after a good security update?
After a well-translated security update, a board member should be able to say: these are the two or three risks we are most exposed to right now; here is the business impact if they materialise; here is what we have decided to do about each; and here is who is accountable. If the update generates blank nods or a single follow-up question about budget, the translation has not worked.
Does the vCISO attend board meetings?
In most engagements, yes — typically for a scheduled risk update, quarterly or more frequently depending on the organisation. The format varies, but the principle is that the board should be able to ask questions of the person who owns the risk, not just read a report.
We have an in-house IT director who is technically strong. Can they do this?
An IT director can be a good source of technical input. But the translation function requires independence from delivery pressures — a technically strong IT director is often managing competing priorities and may not have the governance perspective or board-level standing to perform this function effectively.
What makes a risk 'board-level'?
A risk is board-level when the consequences of it materialising are material to the organisation — affecting its financial position, legal standing, regulatory compliance, or strategic objectives. For most organisations handling client data, dependent on IT for operations, or subject to sector regulation, most significant cyber risks clear this threshold.
How do we evaluate the quality of security reporting we're currently receiving?
A practical test: after your next security update, ask your board members — without preparation — to describe your two biggest cyber risks and what is being done about them. If they cannot, the reporting is not serving a governance function.
Summary
The governance gap cannot be closed by better tools or more comprehensive certification. It requires someone with the ability to translate the technical reality of your security environment into the business language your board can act on. That is a specific capability — and it is what the vCISO function is designed to provide.
Want to explore how cyber risk can be translated into meaningful board-level decisions?
Join our upcoming vCISO webinar, where we'll discuss governance, risk ownership, compliance, and practical approaches to improving cyber oversight for growing organisations.
Henry Lawrence
Henry is the Managing Director of ITbuilder. He is also a CISM professional with over 7+years experience leading cyber security strategy and transformation initiatives across public and private sector clients. He has a strong track record of delivering maturity assessments, cyber governance models, and Secure by Design programmes in FS, Public Sector and E&U
More articles from Henry Lawrence
