Cybersecurity dashboards can tell you how many threats were blocked, how many employees completed training and whether an audit was passed. They cannot tell you whether your organisation will make good decisions when something goes wrong.
The most dangerous cybersecurity dashboard may be the one where everything is green.
A CEO can be shown impressive numbers: millions of attacks blocked, 100 per cent policy compliance, 98 per cent completion of annual security training and no major incidents reported.
All of those figures can be true, and the organisation can still be dangerously fragile.
Cybersecurity has traditionally been discussed as a technical discipline. That is understandable. Technology matters enormously. Verizon’s 2026 Data Breach Investigations Report, for example, found that exploitation of software vulnerabilities has become the leading initial route into breaches. But cyber resilience is not determined by technology alone. It also depends on how people behave, how decisions are made, how quickly mistakes are reported and whether the organisation can continue to operate when its assumptions fail.
During my years as a CISO in the Swedish Armed Forces and the Swedish Transport Agency, I learned that senior leaders do not need to become cybersecurity specialists.
They do, however, need to know which questions expose the difference between apparent security and actual resilience.
Here are five I believe every CEO should ask.
1. What happens when someone makes a security mistake?
Do not ask how many employees failed the latest phishing simulation. Ask what happens after someone clicks the wrong link, sends information to the wrong recipient or realises they may have compromised an account.
Do they report it immediately?
Or do they first wonder what will happen to them?
This distinction matters. In a punitive culture, people learn to hide mistakes. In a resilient culture, they learn that early reporting is part of the defence.
No organisation can eliminate human error. A more useful objective is therefore to minimise the time between a mistake occurring and the organisation responding to it.
CEOs should ask their CISO what evidence exists that employees feel able to report mistakes quickly. Look beyond training completion and ask about reporting behaviour, escalation times and what managers actually do when someone admits an error.
The employee who raises their hand five minutes after making a mistake can be an important security asset. The employee who stays silent for five days can unintentionally turn the same mistake into a crisis.
2. Where are our security controls fighting the business?
Security controls are designed to reduce risk. But controls that make legitimate work unnecessarily difficult can create different risks.
People are remarkably good at finding ways to get their jobs done.
If an approved filesharing service is too cumbersome, someone will find another. If access takes days to arrange, credentials may be shared. If corporate AI tools are too restrictive or unavailable, employees may turn to public alternatives.
This is often described simply as employees “breaking the rules”. CEOs should be more curious.
Repeated workarounds can be a signal that security architecture and operational reality are badly aligned.
Ask your CISO where employees most frequently circumvent security controls and why. Then ask whether those behaviours are being treated merely as compliance failures or as information about badly designed processes.
Security that consistently competes with productivity will eventually lose.
The objective is not to remove necessary controls. It is to design them around the reality of how the organisation works rather than around an idealised version of how people ought to behave.
3. How do we know our security culture is actually improving?
One of the easiest metrics to present to a board is the percentage of employees who completed mandatory training.
It is also one of the easiest metrics to misunderstand.
Completion measures participation. It does not automatically measure understanding, changed behaviour or resilience.
A CEO should therefore ask: what is different in the organisation because of the security programme?
Are employees reporting suspicious events faster? Are managers including security in operational decisions? Are recurring mistakes decreasing? Are different parts of the organisation displaying different patterns of risk? Do people know what matters in their own roles rather than simply remembering generic security rules?
There is no single number that measures security culture.
That is not a reason to avoid measuring it. It is a reason to use several indicators that together tell a meaningful story.
A mature CISO should be able to explain not simply what security activities have been completed, but what behaviours the organisation is trying to influence, how those behaviours are being observed and what the organisation is learning from the results.
4. Which critical dependencies are outside our direct control?
Modern businesses do not operate inside a neat corporate perimeter.
Cloud providers, software suppliers, consultants, outsourced operations, logistics partners and increasingly AI services all become part of the organisation’s ability to operate.
CEOs therefore need to look beyond the traditional question: “Are our suppliers secure?”
A better question is: which dependencies could materially disrupt our business, and how confident are we in the way they are governed?
That includes technology, but also people and decision making.
Who can access critical information? How are exceptions handled? Who notices when a supplier’s behaviour changes? Can the organisation operate if a critical provider becomes unavailable? Are responsibilities clear when an incident crosses organisational boundaries?
The UK National Cyber Security Centre explicitly encourages boards to examine cyber risk across supply chains and customers rather than treating cybersecurity as an internal IT issue.
A contract can transfer obligations. It cannot transfer the consequences of a failure.
5. If our critical systems stopped working tomorrow, how long could our people operate safely?
Cybersecurity discussions often focus on preventing attackers from getting in.
CEOs also need to ask what happens when prevention fails.
Imagine that a major operational system becomes unavailable tomorrow morning. Not for ten minutes, but for two days.
Can the organisation still serve customers? Can employees make safe decisions without the normal information available? Do managers know which functions must be prioritised? Have manual alternatives actually been tested, or do they only exist in a continuity document?
This is where cybersecurity becomes organisational resilience.
A technically sophisticated organisation can still be fragile if its people cannot operate when technology is degraded. Conversely, an organisation that has prepared people to make decisions under pressure can retain control even during a serious incident.
The CEO should therefore ask the CISO not only about recovery time objectives and backups, but about the human side of continuity.
What will people actually do?
The CEO does not need to become the CISO
The purpose of these questions is not to move operational cybersecurity responsibility into the CEO’s office.
It is to make cybersecurity discussable as a business issue.
The UK’s National Cyber Security Centre makes a similar distinction in its board guidance: directors do not need to become technical experts, but they do need enough understanding to ask meaningful questions, test the answers and govern cyber risk effectively.
A good CISO should welcome that conversation.
Because the strongest cybersecurity organisations are not necessarily those with the largest technology budgets or the most reassuring dashboards.
They are the organisations in which leaders understand how technology, people, suppliers, incentives and everyday decisions interact — and are willing to examine what happens when those systems are put under pressure.
That is where resilience becomes visible.
Written by Tobias Ander.
Have you read?
Why Strategic Foresight Matters Most During Turbulent Times.
When Should a Brand Reposition? CMO Oleksandr Rodkin Explains.
Why Companies Choose Nift Gifts Over Traditional Advertising.
Are You Achieving—or Quietly Unravelling Under the Pressure?
Breaking Down Barriers to More Collaborative Leadership.
