CyberCQR Thinking · Governance
All green, still exposed: what your board's cyber report is not telling you
A cyber report can only score what the firm knows it has. The devices nobody enrolled, the cloud services nobody approved and the accounts nobody owns never appear in it. If you cannot detect it, you cannot protect it, and a board that sees only green has no way of knowing what is missing.
Summary
The point for boards. Most cyber reports measure activity on the parts of the estate the firm already knows about: patches applied, attacks blocked, a security score. They cannot measure what nobody has found. Before asking whether controls are working, a board should ask how much of the estate it can actually see, whether the firm is inside the risk the board agreed to accept, and which decisions are waiting on the board itself.
If you cannot detect it, you cannot protect it
The National Cyber Security Centre (NCSC) puts the principle plainly: "It's far easier to protect things that you know about" [3]. Every security control, from multi-factor authentication (MFA) to backup to monitoring, is applied to an asset the firm knows exists. An asset nobody knows about gets none of them.
The NCSC calls the unknown part of the estate shadow IT: devices and services used for work that are not tracked or managed by the organisation [4]. It stresses that shadow IT is rarely malicious. It grows when the approved tools do not do what people need, or the request process is too slow [4]. A team shares client files through a personal cloud account to hit a deadline. A director reads email on an unenrolled tablet. A supplier keeps an old remote access account "just in case". None of these will appear in a dashboard built from the systems IT manages.
A security score is a score for the estate you know about. The risk sits in the estate you do not.
What "all green" usually means
We have read many board cyber reports, as in-house security leads and as advisers. A report that is green across every measure, quarter after quarter, is rarely good news. In our experience it usually means one of two things. Either the person writing it does not know the whole estate, and is honestly reporting on the part they can see. Or they know about gaps and have chosen not to put them in front of the board.
The first is far more common, and it is not a personal failing: it is what happens when nobody has asked how complete the picture is. The second is a governance problem. A board cannot tell the two apart from a green dashboard, which is exactly why the report needs to change.
There is a second blind spot. Activity measures, such as the number of attacks blocked or the share of staff who passed a phishing test, show that work is being done. They do not show whether the firm is inside the level of risk the board has agreed to accept, which is the only question a board can act on.
Four things a board can act on
1. How much of the estate can we see?
Start the report with coverage, not scores. What share of the devices signing in to our systems do we manage? How many cloud services are in use, and how many have we approved? How many accounts are tied to a current person or a named owner? A firm that can see 95% of its devices but only a third of the cloud services its staff use has a very different risk from the one its dashboard suggests.
2. What have we agreed to accept?
The Cyber Governance Code asks boards to define and communicate their cyber risk appetite [2]. That does not need a framework. It needs a page, written in the board's own terms: client harm, regulatory standing, downtime and data. For example: "We do not accept client data in services we do not manage."
3. Are we inside it?
The Code also asks boards to set suitable metrics and agree tolerances aligned with that appetite [2]. Six to eight indicators are enough, each with a line that, if crossed, the board wants to hear about. Green should mean "inside tolerance", not "work is being done".
4. Which decisions are waiting, and on whom?
Risk is not only about controls; it is also about delay. A recommendation that sits in board papers for three meetings is a risk the board has accepted without deciding to. The same applies during an incident: our briefing on the FCA's new reporting rules shows how the time taken to decide can matter more than the time taken to fix. The report should list every decision awaiting the board, with the date it was first asked for, and every risk the board has knowingly accepted, with the date it is due for review.
What one page each quarter looks like
A good quarterly report fits on one page and answers five questions in order: what can we see, are we inside appetite, what has changed, what have we accepted, and what do we need you to decide? Our Good Practice Guide includes a template and a library of indicators, most of which a firm can measure with tools it already pays for. Our interactive board self-assessment lets a board estimate, in a few minutes, how much of its estate it can actually see.
Five questions for your next board meeting
- What share of the devices, cloud services and accounts our people use for work can we actually see and manage?
- Have we written down, in our own words, the cyber risk we are prepared to accept?
- Which of the measures in our report has a tolerance, and what happens when one is crossed?
- Which cyber decisions are waiting on this board, and how long has each been waiting?
- Who, independent of the people doing the work, has checked that this report is complete?
Conclusion
A board does not need more cyber data. It needs to know how much of the estate is in view, whether the firm is inside the risk it has chosen, and what is waiting for its decision. A report that answers those three things will rarely be all green, and that is the point: it is the first report the board can actually govern from.
Glossary
| Term | Meaning |
|---|---|
| Coverage | The share of the devices, services and accounts in use that the firm knows about and manages. |
| Cyber Governance Code of Practice | Government guidance, published in April 2025, setting out what boards of medium and large organisations should do to govern cyber risk. |
| Key risk indicator | A measure that shows whether a risk is moving towards or away from the level the board will accept. |
| Multi-factor authentication (MFA) | Signing in with something beyond a password, such as an app prompt or a security key. |
| Risk appetite | The level and kinds of risk the board is prepared to accept in pursuit of the firm's goals. |
| Shadow IT | Devices and services used for work that the organisation does not know about or manage. |
| Tolerance | The limit on an indicator beyond which the board wants to be told and expects action. |
Table 1. Terms used on this page (alphabetical).
Further reading
From CyberCQR
- Cyber risk reporting: ten actions for boards
- Measuring and reporting cyber risk to the board: a good practice guide
- How much of your estate can the board see? (interactive)
- More tools, less security
External
References
- [1]Department for Science, Innovation and Technology and Home Office, Cyber security breaches survey 2025/2026, 30 April 2026.
https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026 - [2]Department for Science, Innovation and Technology and National Cyber Security Centre, Cyber Governance Code of Practice, 8 April 2025 (actions A3 and E2).
https://www.gov.uk/government/publications/cyber-governance-code-of-practice/cyber-governance-code-of-practice - [3]National Cyber Security Centre, Asset management, May 2021.
https://www.ncsc.gov.uk/guidance/asset-management - [4]National Cyber Security Centre, Shadow IT: managing 'unknown assets' that are used within an organisation, July 2023.
https://www.ncsc.gov.uk/pdfs/guidance/shadow-it.pdf - [5]National Cyber Security Centre, Cyber Security Toolkit for Boards.
https://www.ncsc.gov.uk/collection/board-toolkit
Security is the outcome, not a solution.
CyberCQR is a UK cyber security advisory practice. We help boards see the whole estate, set a cyber risk appetite and get one honest page every quarter, without vendor commissions or product resale.