• Translate threats into business impact. Boards respond to lost revenue and downtime, not malware names.
• Use the four impacts framework. Frame every risk as financial, regulatory, reputational, or personal accountability.
• Build understanding before an incident. Tight reporting deadlines (NIS2, DORA, SEC) mean the board can’t learn this mid-crisis.

The stakes and the four business impacts

Cyber risk becomes a boardroom priority when its business consequences are clear. Many security teams still report risk in a language boards don’t speak. “APT29 is exploiting a new vulnerability” describes a threat. “An attack exploiting this vulnerability could halt order intake for three weeks and erase six months of profit” explains what is at stake. The CISO’s challenge is to bridge that gap, turning technical intelligence into clear business language and a case for action.

Until recently, translating risk into business terms was good practice. In 2026, it is becoming close to mandatory. Regulators now hold management personally accountable for approving and overseeing cyber risk, and leaders cannot oversee what they cannot understand.

NIS2 has been transposed by 23 of 27 EU member states, and enforcement is underway. In July 2026, the Commission referred the four countries (Ireland, Spain, France and the Netherlands) to the EU Court of Justice and asked for daily penalties. National authorities such as Italy’s ACN have opened proceedings against entities that failed to register.

The reporting timelines are short:

• NIS2, requires an early warning within 24 hours of becoming aware of a significant incident, a full incident notification within 72 hours and a final report within one month
• DORA, which has applied to EU financial entities since 17 January 2025, with no grace period is stricter. Financial entities must submit an initial notification within 4 hours of classifying an incident as major, and no later than 24 hours after detection, followed by an intermediate report within 72 hours and a final report within one month.
• In the US, listed companies must disclose a material cyber incident within four business days of deciding it is material.

DORA is stricter, taken together, these timelines mean the board’s understanding of cyber risk can’t be built during an incident. It has to exist before one.

At the same time, attacks got faster and cheaper because of AI. As Erik Dierks wrote in an RSAC blog , AI “changes the scale and speed” of how people and technology interact “. IBM’s 2026 breach study found AI in one in four malicious breaches. In 2025 Anthropic disclosed the first documented espionage campaign was run mostly by an AI agent. Boards have watched real losses in earnings: Marks & Spencer, Jaguar Land Rover and Boston Scientific all reported major financial hits from cyberattacks in the last 18 months.

Bridging the gap between technical detail and business impact is at the heart of the CISO’s role. Part One part looks at what has raised the stakes and sets out a simple framework for describing any cyber risk in terms the board already uses. Part two covers the practical toolkit for building that case.

Why it matters

Executives care about financial performance, operational resilience, reputation, and personal accountability. A malware name alone tells them little; its potential impact on the business is what matters.

• Breaches are getting more expensive: IBM and Ponemon put the 2026 global average at $4.99M, a record high and 12% above 2025.
• AI-driven attacks carry a premium: they rose 56% year over year and cost about $1M more per breach than attacks without AI. Deepfake impersonation was the largest category.
• Security spending shows a measurable return: Organizations that use security AI and automation extensively paid about $1.93M less per breach. That is a story boards want to hear, and it only lands when risk is tied to business outcomes.

There is also a trap to avoid. Teams can drift toward the “interesting” attack. A novel nation-state implant makes a better conference talk than an unpatched VPN, but the VPN is often the one that costs money. Leading with business impact keeps the conversation on the risks that matter most.

The four business impacts framework

Frame each risk in the impact types the board already manages: financial, regulatory, reputational, and personal accountability. Here is how to phrase each and what to bring to the meeting:

1. Financial

Translate disruption into financial exposure using your organization's own figures: “A ransomware attack on our order platform could interrupt sales for three weeks, putting USD xxx in revenue at risk each week, alongside recovery costs and potential SLA penalties.”

Jaguar Land Rover is a useful reference case. Analysts estimated it was losing approximately £50 million a week during its nearly six-week production shutdown in 2025. This example provides context; it is not intended to substitute for an assessment of your own exposure.

2. Regulatory

Express regulatory exposure as the deadlines and penalties your organization would actually face: “Under NIS2, we would need to submit an early warning within 24 hours and a full incident notification within 72 hours. As an essential entity, we could face fines of up to €10 million or 2% of global annual turnover, whichever is higher.” For banks and insurers, the DORA timeline is tighter. An initial notification is due within 4 hours of classifying an incident as major.

Regulators are already issuing large penalties after cyber incidents. The UK Information Commissioner’s Office fined Capita £14 million after its 2023 ransomware attack, and Korean regulators fined Coupang KRW 423.6 billion after a breach affecting millions of customers.

3. Reputational

Tie a potential incident to visible customer impact rather than abstract brand damage: “A customer-data breach on this platform could put us in the same headlines as the 2025 UK retail incidents, with weeks of lost online sales and lasting damage to customer loyalty.” Marks & Spencer is a relevant reference case: it halted online sales for about six weeks after its 2025 attack. Use that example to make the scenario tangible, then estimate what a similar disruption would mean for your own customers and sales channels.

4. Personal accountability

Make clear that cyber risk now carries individual responsibility at board level: “NIS2 makes management bodies personally accountable for approving and overseeing cybersecurity risk-management measures. If we are a US-listed company, some of the people in this room may also be involved in assessing whether a cybersecurity incident is material - a determination that triggers the four-business-day disclosure deadline under SEC rules.” Frame this as a governance point rather than a warning. The aim is for decision-makers to understand their role before an incident, not during one.

Where possible, consider using your own revenue and run-rate figures. Boards usually trust their own numbers more than industry averages.

In Part Two, we will cover the four impacts to help the board understand what is at stake. The focus is on making the case concrete and credible: mapping attacker tactics to business impact, framing potential losses in earnings terms, using memorable analogies, and demonstrating confidence in the intelligence underpinning the numbers.