Executive intelligence: turning test results into board decisions
Security reports only help if the people who control the budget can read them. A listed group had years of thorough technical reports, yet its board had never acted on one. We helped its chief information security officer (CISO) present the same findings in the language of money, risk and decisions.
The client
This was a listed group with an audit committee, a risk committee and the governance expectations set by Indonesia’s Financial Services Authority (OJK). Its CISO had presented three years of technical reports and had not secured a budget increase. The board’s message to him was blunt: “Speak business or stop presenting.”
Why the reports weren’t landing
The previous penetration test report (the write-up of an authorized, controlled attack on the company’s systems) ran to 120 pages. It listed dozens of “critical” issues by their technical identifiers, with no link to money or daily operations. Directors could not tell what mattered most, so nothing was decided.
What we built instead
We kept the technical findings and rewrote how they were presented to leadership.
- For each top risk, we modeled the possible loss from fraud, a service outage, a data breach that must be reported under the Personal Data Protection Law (UU PDP), or an OJK sanction. We used ranges, because a single precise figure would have been false comfort.
- A one-page risk summary, backed by a five-slide appendix showing the trend in the company’s security, the five biggest risks, and the options for each: fix it, reduce it, or accept it with a named owner and a date.
- A plain-language check: no technical identifiers on page one, and every technical term paired with what it would mean for the business.
- A briefing to help the CISO answer the board’s questions.
What the analysis showed
Three risks carried most of the modeled loss: a flaw in how payment confirmations were handled, a way to take over the single sign-on system, and backups that could not be reliably restored. Fixing all three would cost a small fraction of what a single incident could. The 120 “critical” items from the old report came down to three decisions for the board and nine items the teams could schedule themselves.
What the board decided
The board approved funding for the fixes. Each business unit now owns its share of the work with a deadline, instead of it being filed away as an IT problem. The CISO reports every quarter rather than once a year, and the security trend is now a regular item on the risk committee’s agenda. Engineers still receive the full technical appendix, so the same data serves both audiences.
If your own board hears regular security updates but rarely decides anything, the fix is usually in how the findings are presented.