Your Board Stopped Trusting the Dashboard. Now It Wants to Know Who Built It
October 9, 2026
Randy Hall, CEO— AI-assisted and reviewed prior to publication.
Most boards no longer believe their cybersecurity reporting tells them anything useful, and that skepticism is becoming a staffing decision. New Gartner research found that a large majority of non-executive directors lack confidence that cybersecurity spending is producing real value, which means the credential sitting behind your next security hire now matters as much as the headline you put in front of the board.
Why don't boards trust their own cybersecurity reporting?
Boards don't trust the reporting because it reads like a compliance checklist instead of a business case. The 2026 Gartner Board of Directors Survey, conducted among 330 non-executive directors across North America, Latin America, Europe and Asia Pacific, found that boards struggle to connect cybersecurity investment to outcomes they can actually evaluate.
Gartner's Kristin Moyer put it plainly: boards often cannot tell whether dashboards and compliance updates mean the company is safer, because the reporting "can confuse rather than reassure, leaving NEDs uncertain about whether their organization is truly more secure." That is not a presentation problem you fix with better slides. It is a trust problem, and trust attaches to people, not charts.
Gartner analysts have started telling CISOs to abandon security-native formats entirely. At the 2026 Security and Risk Management Summit, analyst Tom Scholtz told attendees that the reports boards actually read are structured around the business, not around the security function, using financial reporting as the template rather than technical metrics. The implication for staffing is direct: you need someone in the room who thinks in governance and business value by training, not someone who was promoted into the board seat because they were the most senior engineer available.
What is the board actually asking for when it asks for better reporting?
It is asking who owns the answer and whether that person has the standing to be believed. The NACD's Director's Handbook on Cyber-Risk Oversight, now in its fifth edition, frames this as a relationship problem as much as a reporting problem. Its companion survey data shows that improving the board-CISO relationship is a stated priority for a substantial share of directors at both public and private companies, and the handbook pushes boards to demand reporting built on business metrics like revenue loss and regulatory penalty exposure rather than technical jargon.
That shift shows up in filing requirements too. Under Regulation S-K Item 106, companies must disclose which management positions are responsible for cybersecurity risk and describe their relevant expertise, and compliance analysts note that this disclosure can and does include formal certifications such as CISSP as evidence of that expertise. Notably, the SEC chose not to require disclosure of cybersecurity expertise at the board level itself, reasoning that directors with broad risk and strategy skills can oversee management's efforts without specific subject-matter expertise. That decision pushes the credentialing burden downward, onto the management layer that reports to the board, which is exactly where a governance-trained leader earns their keep.
The reporting-line math is already moving
CISO access to the board has been rising for several years, and that trend is now colliding with the confidence gap Gartner identified. The table below pulls together what current survey data shows about how often security leaders actually reach the board, and how little of that face time translates into stated director confidence.
| Data point | Figure | Source |
|---|---|---|
| Non-exec directors lacking confidence in cybersecurity value | Large majority surveyed | 2026 Gartner Board of Directors Survey |
| Public-company CISOs reporting to the board quarterly | 62%, up 14 points year over year | Hitch Partners 2025 CISO Leadership Survey |
| Directors who say improving the board-CISO relationship matters | 37% public, 40% private | NACD 2025 Board Practices and Oversight Survey |
More face time without a credible translator does not close the gap. The Hitch Partners 2025 CISO Security Leadership Survey found that board exposure for public company CISOs has grown steadily, yet the same period produced the Gartner finding that most directors still doubt whether any of that reporting proves value. Access to the room was never the bottleneck. Being believed once you're in it is.
Why governance certification is the credential boards are starting to recognize
Technical certifications prove you can secure a system. Governance-focused credentials prove you can translate that work into the strategic alignment, risk optimization, and resource accountability language a board already uses to evaluate every other investment. That distinction is becoming a market signal in its own right. ISACA's own analysis of the 2026 certification market describes governance as having moved from a back-office compliance function to a board-level imperative, naming its governance-specific credential among the fastest-growing in the field precisely because of that shift.
This is the gap Forge University's CGEIT certification prep is built to close. The credential is framework-neutral and built around four domains, governance of enterprise IT, IT resources, benefits realization, and risk optimization, which map almost directly onto the business metrics boards say they want: value delivery, cost of control, and return on risk-reduction spend. A security leader who holds it isn't just reporting incident counts. They're positioned to answer the question a skeptical director actually asks, which is whether the money spent is buying anything real.
If your organization is weighing which credential to fund for the people who will eventually sit across the table from your audit committee, the comparison is worth doing properly rather than guessing from job postings. Forge University's certification resources hub breaks down domain weightings and prerequisites across the governance, risk, and technical tracks side by side, which makes it easier to match the credential to the actual reporting gap you're trying to close. For most organizations building that bench now, rather than after the next director survey comes back worse, the practical step is to start training the people already closest to the board relationship before the next 10-K cycle forces the question.
What this means for the certification budget conversation
None of this argues for abandoning technical certifications. Security operations, penetration testing, and incident response credentials still prove the underlying work gets done, and boards still need to know that layer is covered. What's changed is that a board confidence gap this wide, documented by Gartner at this scale, is no longer a communications problem a slide template can fix on its own.
The organizations that close the gap first will be the ones that put a governance-credentialed person between the technical program and the boardroom, someone fluent enough in both languages to make the reporting land. That person's title might be CISO, VP of risk, or head of IT governance. Their credential is increasingly the thing that tells the board whether to believe what they're hearing.
Budget owners deciding where the next training dollar goes should treat this as a straightforward return calculation. A technical certification protects the system. A governance certification protects the relationship between the people who run that system and the people whose job is to ask hard questions about it. Boards are telling researchers, in survey after survey, that the relationship is the part currently failing. That's the part worth funding first.