A survey showing that a majority of boards rank a particular risk as a top concern is a genuinely interesting data point about board sentiment. It is not evidence that the risk is your organization's top concern, and presenting it as if it were is one of the more common ways a governance conversation drifts away from the organization's actual exposure.Sentiment Is Not the Same as ExposureA survey captures what respondents say they are thinking about, which is shaped heavily by what has been in the news, what a peer recently experienced, and what a vendor has been pitching. None of that is a substitute for an assessment of your own systems, your own data, and your own control environment. A risk can be fashionable and irrelevant to you at the same time, or unfashionable and highly relevant.Using Survey Findings Without Being Led by ThemTreat a survey finding as a question, not an answer: 'is this actually a risk for us' is the right response to a survey headline, not 'we should prioritise this because others do.'Check the respondent pool: a survey of security vendors' customers, or of a single region, is not the same population as your board's peer set, however it is marketed.Separate stated priority from measured exposure: a survey rarely audits whether respondents' organizations are actually well-positioned against the risk they named as a top concern.Let your own risk register lead the agenda: a survey is a useful cross-check against it, not a replacement for the work of building it.“A survey tells you what a room full of other people are worried about. It was never going to tell you what you should be.”Where a Survey Genuinely HelpsUsed well, an industry survey is a prompt to re-examine an assumption rather than a source of new priorities: if a risk the survey highlights isn't on your register at all, that gap is worth investigating. If it is already there and already assessed, the survey has told you your peers are catching up to a conclusion you had already reached.Share this articleX (Twitter)LinkedInFacebookCopy Link
Industry SurveyMay 13, 2026What Self-Reported Survey Data Usually Gets WrongA survey asking security leaders to rate their own programme's maturity is measuring confidence as much as it is measuring maturity, and the two are not always the same thing.
Benchmark StudyAug 16, 2026Why Cross-Industry Benchmarks Rarely Transfer to Your OrganizationA benchmark built from a mixed sample of industries tells you what an average organization does. It rarely tells you what your organization, with your specific risk profile, should do.
Research ReportJun 19, 2026The Difference Between a Report and a DecisionA well-produced report can sit on a governance committee's agenda for months, cited approvingly, without ever changing what the organization actually does. That is not the report's failure. It is what happens when reading one is mistaken for acting on it.
