- Translate cyber risk into business impact: revenue, EPS and peer ransomware losses.
- Show confidence in your threat intelligence: rate source quality, freshness and relevance.
- Bring the board a cyber risk decision: accept, reduce or insure.
Part One looked at why cyber risk now belongs on the board agenda and how to describe any risk in four business terms: financial, regulatory, reputational and personal accountability. This blog covers how to make those impacts land in the room. It offers four techniques: map attacker tactics to business impact, tie threats to earnings, use analogies a director can repeat, and say how confident you are in the numbers.
Map attacker tactics to business impact
The classic board visual is a heat map with likelihood on one axis and business cost on the other. It’s value depends of the rows. If they describe how attackers operated three years ago, the map will steer money toward yesterday’s problems . Build the rows from current threat intelligence about your sector, then score each one for likelihood and cost using your own data.
The table below is a starting set of rows for 2026
| Attacker tactic | Business impact | How you could phrase it to the board |
| Deepfake executive impersonation (ATT&CK T1656) | Fraudulent payments, approval-chain abuse | “A cloned voice or video of our CFO could authorize a transfer. Arup lost about $25M this way across 15 transfers.” |
| AI-generated phishing and BEC (T1566) | Credential theft, payment fraud | “Phishing no longer has typos. It’s safer to assume every finance user will get a convincing, personalized lure. A single scheme of this kind cost Orion S.A. about $60M in fraudulent wire transfers. The FBI counted almost $3.05B in BEC losses in 2025, with more than $30M already tied to AI-generated emails and voice cloning” |
| Help-desk social engineering and valid accounts (T1078) | Full domain compromise, ransomware | “One phone call to our service desk could reset an admin password. M&S’s chairman confirmed attackers got in by impersonating an employee to the outsourced service desk. At Coinbase, bribed support staff leaked customer data, followed by a $20M extortion demand.” |
| Ransomware and data extortion (T1486) | Weeks of downtime, lost sales, recovery costs | “M&S expected about £300M in lost operating profit. Cencora paid a $75M ransom and reported $31.4M in remediation costs. That is a realistic scenario for us if online ordering goes down.” |
| Software supply-chain compromise (T1195) | Mass exposure through a trusted tool, regulatory reporting | "A poisoned open-source package could enter every build overnight. The trojanised axios library, present in about 80% of cloud environments, was live for hours in March 2026.” |
| Attacks on our own AI apps (prompt injection, MITRE ATLAS) | Data leakage through chatbots and agents | "IBM puts prompt-injection breaches at about $5.9M on average. Our customer assistant is now part of our attack surface.” |
| Data exfiltration (TA0010) | IP theft, lost competitive lead | “Our R&D spend on [program] is [USD xxx] a year. If it were stolen, a competitor could skip [x months] of that work.” (illustrative) |
Whenever you can, fill the first and last columns from your own threat intelligence and figures. Generic lists tend to produce generic budgets.
Link threats to earnings and valuation
The most persuasive numbers on a board slide are the ones companies have reported to their own investors. Recent years have produced plenty of them.
| Year | Company | What it cost (as reported) |
| 2026 | Boston Scientific | About $150M revenue headwind in Q3 after an August attack. Full-year guidance cut. |
| 2025 | Jaguar Land Rover | About six weeks of halted production. Estimated £1.9B hit to the UK economy and 5,000+ organizations affected |
| 2025 | Marks & Spencer | About £300M expected profit impact. First-half net profit down 98%. |
| 2024 | UnitedHealth / Change Healthcare | Estimated $2.87B for fiscal 2024 |
| 2024 | Cencora | $75M ransom paid after a $150M demand, plus $31.4M remediation and $40M legal costs. |
| 2023 | Capita | £20M remediation cost and a £14M regulatory fine; about 6 million records affected. |
| 2023 | MGM Resorts | About $100M hit to quarterly earnings. |
Two ways to make these numbers work harder:
1. Speak in earnings per share and guidance. Boston Scientific’s CFO put the Q3 hit at roughly $150M of revenue and $0.07 of EPS - the units your CFO and investors already use.
2. Show the long tail. Compare tech’s analysis of breached NYSE-listed companies found share prices bottomed about 14 trading days after disclosure, and three years on the companies were still underperforming the NASDAQ by about 15%.
Use analogies a director can repeat
A good analogy turns a technical alert into a decision in one sentence, and AI-era threats benefit from analogies of their own. A few you might adapt:
| Instead of… | You could say… |
| “We’re seeing infostealer activity and leaked session tokens.” | “Someone has copies of our staff’s office keys. Changing the locks is cheaper than finding out which doors they tried.” |
| “Deepfake impersonation risk in payment approvals.” | “The person on the video call may not be the CFO. A code word, like a bank’s call-back check, would help.” |
| “An AI-orchestrated intrusion ran 80–90% of tactical steps autonomously” (GTG-1002, per Anthropic). | “Attackers now have an intern who never sleeps, tries every door in parallel and learns as it goes. Our response needs to be just as fast.” |
| “Prompt injection against our LLM assistant.” | “Our chatbot could be talked into reading out the filing cabinet, like a new receptionist who believes anyone in a hi-vis vest.” |
| “Supply-chain compromise via an npm dependency.” | “A trusted supplier’s delivery van was hijacked. Everything it delivered this week is worth checking.” |
The test: could a non-technical director repeat your sentence to someone else accurately?
Show how much you trust the intel behind the numbers
Boards are increasingly asking a second question: “How sure are you?” In 2026 that question has a technical answer, and it helps to have it ready.
The 2025 GTG-1002 campaign showed attackers handing 80–90% of tactical work to an AI agent. Defenders are answering with machine-speed response, which only works if the inputs are trustworthy.
With that in mind, you might add a short confidence line to each risk you present, covering:
- Source quality. How many independent sources confirm this? Is it vendor-reported, government-reported or seen in our own telemetry?
- Freshness. How old is the indicator or assessment? A three-month-old IoC list is closer to history than intelligence.
- Relevance. Does this actor target our sector, region and technology stack?
- Automation guardrails. Which actions can our tools take automatically on this intel, and which need human approval?
You don’t need to invent a scale. The Admiralty Code, used by NATO and many CTI teams, grades source reliability from A to F and information credibility from 1 to 6. “B2: usually reliable source, probably true, seen in our network” is a sentence a board can weigh.
A risk with a stated confidence level is often more credible than one with a bigger number. It also protects the CISO: when a forecast turns out wrong, the record shows how much weight it was given and why.
For the guardrails, get the board’s approval once and in advance. Agree which automated actions fall within risk appetite, such as isolating a laptop, and which need an executive decision, such as taking a revenue system offline. That way the decision isn’t being made for the first time at 2 a.m.
The bottom line
Regulators now expect boards to understand cyber risk, AI has pushed attack speed well past quarterly reporting cycles, and directors want to know how much to trust the numbers they are shown. The CISO who gets action is the one who arrives with a decision to make, not a threat briefing. For each priority risk, bring the business impact in the board’s own figures, your confidence in the intelligence behind it, and three priced options: accept it, reduce it with specific controls, or transfer part of it through insurance. Directors don’t need to understand every threat. They need enough to choose between those three options and defend the choice later.