The Translation Gap: Why Boards and CISOs Talk Past Each Other
Every board has a blind spot, and it is rarely the threat itself. It is the distance between what the security team finds and what the board can actually act on. In the first episode of The Blind Spot, Jason Lee sits down with Antonio Bovoso, author of The Boardroom CISO, to take that gap apart and show how a security leader can close it.
The Blind Spot is Z Cyber's new podcast, hosted by Managing Director Jason Lee. It is a show about what happens after the risk is visible, with the CISOs, operators, and risk leaders who have lived the tradeoffs. For the first episode, Jason brought in Antonio Bovoso, a cybersecurity executive with roughly 25 years in the field, founder of Consiro Advisory, and the person who wrote the board-readiness playbook he wishes he had had early in his own career.
The conversation centers on one idea: boards and security leaders are often on two different planes, and most of the friction between them is a translation problem. Here are the moments worth carrying into your next board meeting.
The gap is language, not competence
Finance and sales walk into the boardroom already speaking the board's terms. They talk about revenue, margin, and growth, because that is what a board is there to govern. Security too often shows up with tactical metrics and worst-case scenarios for an audience whose job is to allocate capital, not to operate a SOC. The board is not slow, and the CISO is not failing. They are speaking two different languages, and nobody has agreed to learn the other's. Naming that gap is the first step to closing it, and it is the same gap our guide to cybersecurity board reporting is built to address.
Reframe risk as enablement, not fear
Fear stops working the higher you go. A board that hears doom and gloom every quarter eventually tunes it out. Antonio's reframe is to tie cybersecurity to the way the business already makes money, so security reads as something that enables the company to move rather than something that slows it down. The shift is from "here is everything that could go wrong" to "here is the risk, here is what it costs us, and here is what I recommend we do about it." That is a decision a board can own.
Network sideways before you go up
One of the most practical ideas in the episode is to network across the organization before presenting upward. Sit with the other business leaders, learn their roadmaps, and look at how they frame their own board decks. The language that already works for finance, product, or operations is language the board already trusts. Borrowing it is faster than inventing a security dialect and hoping it lands.
Kill the vanity metrics and the museum-quality deck
"We blocked one hundred thousand attacks" means very little to a board. It is activity, not insight, and it is exactly the kind of vanity metric that crowds out the one number that matters. Antonio's advice is to bring three to five slides, with a single slide that carries the whole message even if you only get three minutes. The test is simple: if the board saw only your first slide, would they still know what to decide? Our breakdown of cybersecurity KPIs for a board dashboard and our CISO board report template both follow the same principle.
He is just as direct about AI in board presentations. As he puts it:
"I will pay you to not use AI for your board presentation."
The point is not that AI is useless. It is that a generated deck looks polished and governs nothing. A board cannot make a decision on a vibe, and the best board deck Antonio ever saw belonged to finance: black and white, not a single color, one hundred percent signal.
Need help translating cyber risk for your board?
Z Cyber's forward-deployed team turns findings into board-ready decisions, not a binder that sits on a shelf.
Read the room, and know where liability lands
Body language tells you when you have lost the board. A good presenter watches for it and adjusts in the moment instead of pushing through the remaining slides. Antonio is also clear that liability is owned in layers across the organization, which is why the recommendations a security leader makes should be documented. The goal is not to shift blame. It is to make the decisions, and the ownership of them, explicit.
The one question
The Blind Spot closes every episode with a single question: what is the one thing you wish the other side of the conversation understood? Antonio's answer reframes the whole relationship between security and the board:
"I wish they understood how much we want to help them."
Listen to the full episode
The full conversation runs about 47 minutes and is worth the time for anyone who briefs a board or sits on one. Watch or listen here:
Antonio Bovoso is the founder and managing principal of Consiro Advisory and the author of The Boardroom CISO, written to give security leaders the board-readiness playbook he wishes he had had early in his career. New episodes of The Blind Spot are released every two weeks. If translating cyber risk into board-level decisions is work your team is carrying alone, talk to a Z Cyber advisor.
Frequently Asked Questions
Why do boards and CISOs talk past each other?
Boards and CISOs are often on two different planes. A board's job is to govern and allocate capital, so it thinks in terms of revenue, risk, and outcomes. Security leaders often arrive with tactical metrics, acronyms, and worst-case scenarios. Finance and sales already speak the board's language, while cyber too often presents activity instead of decisions. The gap is one of language and framing, not competence, and it closes when the CISO translates risk into the terms the business already uses.
How should a CISO present cyber risk to the board?
Lead with the decision, not the activity. Frame cyber risk as enablement of the business rather than fear, tie it to how the company actually makes money, and cut vanity metrics like the number of attacks blocked. Bring three to five slides, with a single slide that carries the whole message even if you only get three minutes. Borrow the language other leaders already use in their own board decks, and document the recommendations you make.
What is the translation gap in cybersecurity?
The translation gap is the distance between what a security team finds and what a board can act on. The risk itself is usually known. What goes unseen is the work of turning a technical finding into a business decision an executive audience can own and fund. Episode one of The Blind Spot is about closing that gap.
Who is Antonio Bovoso?
Antonio Bovoso is a cybersecurity executive with roughly 25 years in the field, the founder and managing principal of Consiro Advisory, and the author of The Boardroom CISO. He is the first guest on The Blind Spot, Z Cyber's podcast hosted by Jason Lee.
Where can I listen to The Blind Spot?
The Blind Spot is available on YouTube, Spotify, and Apple Podcasts. You can watch or listen to this episode, The Translation Gap, on its page at ztekcyber.com/resources/the-blind-spot/episodes/the-translation-gap. New episodes are released every two weeks.
Subscribe for Updates
Get cybersecurity insights delivered to your inbox.
