You have fifteen minutes on the board agenda, and the topic is security. Perhaps an incident nearby prompted it, perhaps the insurance renewal raised questions, or perhaps a director simply asked whether the organization is protected. You know the program has gaps, you suspect some of them need money, and you know that the people in the room think about revenue, liability, and reputation, and have never once thought about door hardware. The question is how to present security risk to a board in a way that leads to a decision rather than a polite nod.
I have briefed boards, councils, and executive committees across public agencies and private organizations, and I have watched capable security people lose the room in the first two minutes. They lose it by speaking in the language of their own field. The board does not need to learn security. The presenter needs to translate it, and the translation is more straightforward than most people expect.
Speak in Consequences, Not Controls
A board does not care about cameras, readers, or patrol frequencies. It cares about what happens to the organization if something goes wrong. So every point you make should start with the consequence and work backward to the control. Instead of reporting that the loading dock has no reader, report that anyone who has ever held a contractor badge can enter the building after hours, that the organization would be unable to prove otherwise after a theft or an assault, and that the fix is a reader and a quarterly credential review. The board now understands the exposure in terms of liability and reputation, which are the terms it uses every day.
The four consequences a board reliably responds to are harm to people, interruption of operations, legal and regulatory liability, and damage to reputation. Every security finding maps to at least one of them. If you cannot connect a finding to one of those four, it may not belong in the board presentation at all, and it should go in the operational report instead.
How to Present Security Risk to a Board With Evidence
Boards are skeptical of fear and receptive to evidence. A presentation built on what could happen invites the response that it has not happened yet. A presentation built on what you found when you tested the program is much harder to dismiss. Tell the board that you walked the perimeter after hours and found a specific number of doors that did not latch. Tell them you called the alarm monitoring company and the call list led with someone who left the organization two years ago. Tell them you compared the access list against the employee roster and found a specific number of active credentials belonging to people no longer with the organization. Tell them you ran the incident plan as a tabletop and it broke at a specific decision nobody was authorized to make.
These are facts, they are recent, and they are yours. They are also the product of the discipline I describe in Until Tested: Security Is Only Assumed, where the P.R.O.O.F. framework is built around verifying that a program works through testing rather than assumption. A board that hears test results understands immediately that the organization’s security has been assumed rather than known, and that realization does more to unlock a decision than any amount of warning.
Rank, Then Ask for Something Specific
Never present a board with a long undifferentiated list. Present the three to five findings that matter most, ranked by the harm they enable and the ease with which they could be exploited, and be clear about what you are asking for on each. Some findings need no money and no board action, and you should say so, because it establishes that you are already fixing what you can. Some need a modest budget that sits within management’s authority, and the board should hear that it is being handled. A few need a board-level decision, usually about capital, staffing, or a vendor contract, and those are the reason you are in the room.
For each board-level item, give a range rather than a false precision. Explain what the organization gets for the low end and what it gets for the high end. Explain what happens if the board decides to do nothing, in the same plain language of consequences. Then stop talking and let them decide. Boards respect a presenter who asks a clear question and tolerates the silence that follows.
Avoid the Three Common Failures
The first failure is the equipment tour, where the presenter walks through the systems the organization owns and the board leaves reassured by the inventory without learning whether any of it works. The second is the catastrophe brief, where the presenter describes worst-case scenarios in detail and the board either dismisses them as unlikely or becomes anxious without knowing what to do. The third is the technical deep dive, where the presenter explains how the systems function and the board stops listening around the third slide. Each of these is comfortable for the presenter and useless to the board.
The antidote to all three is the same. Lead with what you tested, report what you found, state the consequence in board language, rank the items, and ask for a decision. If the whole presentation fits on two pages and takes ten minutes, you have done it right and the remaining five minutes will go to questions, which is where the real work with a board gets done.
Make It a Rhythm, Not an Event
The organizations that handle security well do not brief the board once after a scare. They brief it on a schedule, usually annually with a shorter update at mid-year, and each briefing reports what was tested since the last one, what was found, what was fixed, and what remains open. Over a few cycles the board develops a working understanding of the organization’s security posture and a sense of whether it is improving. That understanding is what makes the board willing to fund the program before an incident rather than after one.
Someone has to own that rhythm, and it should be someone who can both run the tests and speak to the board as a peer. In most mid-sized organizations there is nobody in that position, which is why security appears on the agenda only when something goes wrong. A part-time executive security director fills that seat at a fraction of the cost of a full-time hire, and the board briefing is one of the most valuable things the role does. It is the moment when the work of testing becomes the basis for a decision, and it is the reason the organization stops assuming and starts knowing.
Go Deeper
For a full description of the part-time executive model and how the role reports to leadership, start with What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director covers the board relationship in depth, including how to structure the first briefing and how to build the reporting rhythm this article describes.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply