Some version of 'patching coverage held steady this quarter' appears in a great many board packs. It is precise, it is measurable, and it is one of the least useful figures a board can be handed, because a stable coverage number says nothing about whether whatever remains unpatched is trivial or catastrophic.Why a Coverage Number MisleadsCoverage metrics answer 'how much effort was applied,' which is a fair operational question and the wrong board question. A board is accountable for exposure, not for effort, and the two move independently: near-complete coverage that quietly excludes the one system holding customer records is a worse position than lower coverage that excludes nothing that matters.What Replaces a Coverage MetricExposure on the systems that matter most: a small, named list of systems whose compromise would be serious, tracked specifically, rather than folded into an aggregate that dilutes them.Time to close on what was found: not whether something was found, but how long it stayed open once it was — and whether that is improving or slipping.Direction of travel with a reason attached: a number that moved without an explanation of why is not more informative than no number at all.What is still open and why: a short, honest list of exceptions that exist for a reason, rather than a rounded percentage that quietly absorbs them.“A metric a board cannot act on is not evidence of diligence. It is a number that was easy to produce.”The Discipline This TakesReporting this way is harder than reporting a coverage percentage, because it requires deciding, in advance, which systems and which exposures actually matter enough to name individually — a judgment call rather than an automatic export from a tool. That judgment is exactly what a board is paying a CISO to make, and a report that skips it in favour of an easy aggregate has quietly outsourced the judgment to whoever built the dashboard.Share this articleX (Twitter)LinkedInFacebookCopy Link
Board AlignmentAug 11, 2026Getting the Board to Treat Cyber Risk as Business RiskMost boards already have a rigorous process for weighing financial and market risk. Cyber risk usually sits outside it, reviewed on its own schedule, in its own language.
Risk AppetiteJul 7, 2026Writing a Risk Appetite Statement People Actually UseMost risk appetite statements are signed once, filed, and never consulted again — usually because nobody could apply the wording to an actual decision.
Board AlignmentMay 26, 2026Translating Technical Risk Into Investment DecisionsA board does not need to understand a vulnerability to fund fixing it. It needs to understand what the vulnerability is worth in the currency the board already spends.
