The 2026 CISO-Board Engagement Report: what boards say works, and what doesn't

Boards rate their CISO's cybersecurity updates well when the subject is today's risk, and poorly when it's tomorrow's: 82% call reporting on regulatory trends satisfactory or excellent, but only 47% say the same about explaining the impact of evolving threats, and just 30% describe their relationship with the CISO as strong and collaborative. Those are the headline findings of the 2026 CISO-Board Engagement Report, a joint study by IANS Research, Artico Search and The CAP Group published March 3, 2026, with a follow-up analysis March 24, 2026.

This is a different kind of record from this site's reporting-lines page, which lists who a named CISO reports to as a company's own filing states it, its tenure record, which reads per-company time-in-seat off each company's own 10-K, and the 2026 State of the CISO explainer, which covers career tenure and mobility across the field. This page is about something none of those track: how well a sitting CISO's board updates actually land with the directors receiving them.

Where do boards already have meetings with their CISO?

Reporting itself is no longer the gap. The report found 95% of CISOs deliver regular updates to their boards, 60% of them engaging with the full board rather than a subset.

For the other 35% of boards, the CISO's security updates are confined to a committee rather than the full board, and the time allotted is short: roughly 30 minutes per session.

How effective do directors say the updates actually are?

Asked to rate the overall effectiveness of the cybersecurity updates they receive, just 29% of directors called them "very effective." A majority, 53%, said updates are only "somewhat effective," and 18% were neutral.

Which topics do boards say CISOs cover well?

Breaking the rating down by topic, directors gave their strongest marks to the areas tied to current-state program management, not forward-looking risk: regulatory trends affecting risk (82% rated good/satisfactory or excellent, the top score of six topics rated), cyber program key initiatives (70%) and cybersecurity budget and resourcing (62%, with the highest share, 31%, rated excellent of any topic).

Which topics do boards say CISOs cover poorly?

The weak spots are the forward-looking ones. Explaining the impact of evolving threats was the single worst-rated topic in the study: 53% of directors said it needs improvement, and only 6% rated it excellent.

AI and emerging-technology risk was close behind: 47% said it needs improvement and only 12% rated it excellent.

Cyber business-risk assessment also lagged: 41% said it needs improvement, and only 6% found it excellent.

IANS research director Nick Kakolowski framed the pattern as boards being consistently informed but not yet getting reporting translated into strategic decision-making, particularly as AI reshapes both the threat environment and enterprise risk.

Who was surveyed, and how big is the sample?

The findings come from two separate surveys run by the same group. Board-side ratings are drawn from a December 2025 survey of 17 board directors across public, private and nonprofit organizations; CISO-side figures (such as the 95% update-cadence finding) come from the 2025 IANS CISO Compensation and Budget Survey, with 663 CISOs across North America.

Seventeen directors is a small sample for the specific board-side percentages above; this page states the figures as the report gives them, not as independently verified against the underlying respondent-level data, which isn't public.

FAQ

What is the 2026 CISO-Board Engagement Report? A joint study from IANS Research, Artico Search and The CAP Group, published March 3, 2026, rating how board directors view the cybersecurity updates their CISO delivers, based on a December 2025 survey of 17 directors alongside IANS's 2025 CISO Compensation and Budget Survey of 663 CISOs.

Do boards think their CISO communicates well? Mixed. Only 29% call the updates "very effective" and just 30% describe the board-CISO relationship as strong and collaborative, even though 95% of CISOs already deliver regular updates.

What do CISOs report on well, according to boards? Regulatory-trend reporting rates highest (82% good or better), followed by program initiatives (70%) and budget and resourcing (62%).

What do CISOs report on poorly, according to boards? Explaining the impact of evolving threats rates worst (53% say it needs improvement), followed closely by AI and emerging-technology risk (47%) and cyber business-risk assessment (41%).

How is this different from this site's CISO reporting-lines record? Reporting lines records who a named CISO reports to at a specific company, from that company's own filing. This page is survey data about communication quality across many boards, not a per-company fact.