Executive BriefingBy the PhishSheriff team · February 2025 · 7 min read

Presenting Human Risk to the Board

How security leaders can turn a human risk programme into reporting a board can engage with: choosing metrics, giving them context, telling a twelve-month story and answering the questions directors ask.

Key points

Lead with a clear headline metric, then give it context
Report employee, domain and business measures separately
Show a trend with the interventions marked on it
Prepare for the four questions directors usually ask

On this page

The board reporting problem

Boards struggle with security reporting not because directors lack interest, but because reports are often hard to act on. A slide with fourteen metrics invites no decision and leaves little impression. Directors govern by exception and by trend: they need to know whether risk is rising or falling, how it compares with expectations, and whether the plan is working.

Human risk can be reported clearly because it rests on observed behaviour: how people responded to realistic exercises, and whether they reported them. That gives directors something concrete to discuss.

Choosing the headline metric

A behavioural outcome, such as the proportion of employees who submitted credentials in a realistic exercise, is a useful headline. It is concrete, it can be measured consistently over time, and it answers a question directors care about: how exposed are we? Training completion rates, by contrast, show administrative compliance rather than behaviour.

No single number tells the whole story. Pair the headline with reporting rate, scenario difficulty and participation, and keep employee measures, email-domain measures (such as DMARC enforcement status) and business outcomes on separate lines so they are not confused.

Giving the number context

A figure without context invites the wrong reaction. Anchor it with your own starting point, your target and your trajectory. If you use an external benchmark, say where it comes from and how it was measured, and only compare like with like.

Be open about difficulty. A result measured with demanding, well-targeted scenarios is not comparable with one measured using easy templates, and a programme can create apparent improvement by making its exercises easier. Telling the board that scenario difficulty is controlled, and has increased, builds credibility.

The twelve-month story

One quarter’s figure is a data point; governance needs a story with a shape. Show the trend from your baseline, mark the interventions on it, such as a new cadence, a targeted programme for a high-risk team or a change in scenario difficulty, and explain what you expect next.

Expect a plateau and explain it before it arrives. Early improvement often comes from removing careless mistakes; later improvement depends on new habits, which take longer. A security leader who predicts the plateau keeps the narrative; one who explains it afterwards can appear to be excusing a stall.

The four questions directors ask

Four questions come up again and again. “Are we getting better or worse?” Answer with the trend and the next target. “How do we compare?” Answer with whatever reliable reference points you have, and their limits. “What are you doing about the people who keep failing?” Answer with the targeted support and process controls in place for high-risk roles. “What would it cost us if this fails?” Answer with the business processes most exposed, such as payments and supplier changes, and the controls around them.

All four answers can come from the programme you are already running. Close each presentation with one decision or endorsement you need from the board, such as a change of cadence or an extension to a subsidiary, so directors see that human risk needs something from them too.