CISOs are talking to their boards more than ever. By most measures, that should be progress. Instead, a wave of 2026 research suggests the two sides are having fundamentally different conversations — and neither one realises it until an incident forces the mismatch into the open.
The Numbers Behind the Disconnect
A March 2026 study from IANS Research, Artico Search, and CAP Group put hard numbers on something many CISOs have felt anecdotally for years: visibility is not the same as influence. The survey found that 95% of CISOs now provide regular updates to their boards, yet only 10% of them have any influence over financial decisions tied to security investment. Just 30% of boards described their relationship with the CISO as “strong and collaborative.”
That is a striking gap. Nearly every CISO is in the room; almost none of them are shaping the budget conversation that follows. The reporting cadence has scaled faster than the trust that is supposed to accompany it.
Two Sides of the Same Handshake
A forthcoming report due later this month — “The Two Sides of the Handshake,” surveying 78 board members and 35 security executives — sharpens the picture further. Its preview finding is blunt: CISOs tend to leave board meetings feeling supported and understood, while the directors in the same room leave feeling uneasy about the risk they just heard described.
That asymmetry matters more than a simple communication-style mismatch. If a CISO walks away believing the board is aligned on risk appetite, and the board walks away believing it still doesn’t have a clear picture, the next incident response — and the next budget cycle — starts from two different baselines. Proofpoint’s 2026 Voice of the CISO research, drawn from 1,600 CISOs across 16 markets, points to the same pressure from the other direction: boards are pushing harder on resilience, business impact, and individual accountability, often faster than reporting frameworks have adapted to answer.
What Boards Say They’re Missing
The IANS/Artico/CAP data also breaks down what directors want more of. Reporting on the business impact of evolving threats needs improvement according to 53% of respondents, and reporting on AI-driven risk specifically needs improvement according to 47%. Both gaps show up elsewhere in CISO Daily’s coverage: the same forward-looking blind spot that drives shadow AI governance failures inside the organisation is what leaves boards unable to ask the right follow-up questions about AI-driven vulnerability exposure at the portfolio level.
Gartner’s own June 2026 guidance on board and C-suite briefings reaches a similar conclusion from the practitioner side: board and executive reporting on cybersecurity is growing in both frequency and intensity, but most organisations are still presenting threat counts and heat maps rather than risk framed in terms the board already uses for every other line of business. A CISO Circle session in September proposed borrowing structure directly from financial reporting standards — consistent categories, consistent cadence, consistent units — rather than inventing a bespoke cybersecurity reporting language each quarter.
Closing the Gap: What CISOs Can Do Now
None of this points to a communication failure that more slides will fix. The data suggests three concrete adjustments:
- Replace activity metrics with exposure metrics. Incident counts and patch percentages describe effort, not risk. Boards consistently say they want the business-impact translation layer on top of those numbers — this is the same quantification problem addressed in CISO Daily’s FAIR-based board reporting framework.
- Separate “informed” from “aligned.” A board that received a thorough briefing is informed. A board that agrees with the CISO’s risk appetite and resourcing ask is aligned. Treating the first as proof of the second is exactly the gap “Two Sides of the Handshake” documents.
- Build the AI-risk section before the board asks for it. With under half of boards satisfied on this point today, it will be the first follow-up question in the next cycle regardless of what else is on the agenda.
The Bottom Line
The boardroom has gotten more cybersecurity airtime than at any point in the last decade, but airtime is not the same currency as trust or budget authority. The organisations that close this gap in 2026 will be the ones that stop measuring board engagement by meeting frequency and start measuring it by whether the board’s mental model of risk actually matches the CISO’s — before the next incident tests it for them.