Bearing NW
Board Blind Spots
Gaps in how the board learns about threats: information that stops at management, conflicted executives, and missing expertise.
Why boards miss it
Boards assume material threats will be escalated to them. When the concern involves the people who control the information flow, it often is not. The press, regulators, or a whistleblower become the alarm instead.
Red flags
- The board learns of material matters from the media
- All threat information flows through the CEO
- No director with security or intelligence experience
- Executive sessions rarely include the CISO, CSO, or GC alone
Questions for the board
- What is the last material risk we learned about from outside the company?
- Can our security leaders reach an independent director without going through the CEO?
- Do we have the expertise to challenge management on security matters?
- If a government had concerns about one of us, who would they call?
What individual directors should do
- →Hold regular executive sessions with security, legal, and audit leaders without the CEO
- →Ask 'what are we not being told?' as a standing question
- →Invest in your own security literacy; it is now a core director competency