Blog
Explaining CTEM to a board that has never heard of it
You get ten to fifteen minutes on the agenda, sandwiched between an audit committee update and a real estate decision. Nobody in the room has heard the term CTEM, most have heard “cybersecurity” too many times to want to hear it again, and your job is not to educate them on the threat landscape. It is to get a budget, a headcount, or a continued mandate approved. Those are different jobs, and the second one has a shorter, sharper script.
Speak the board’s language, not the SOC’s
Directors think in terms they already use for every other risk on the agenda: which business processes are exposed, what a disruption costs, and how that likelihood is trending. They do not think in CVEs, CVSS scores, or tool names, and translating on the fly in the room is where these updates go wrong.
The translation is mechanical once you have the data. Instead of a vulnerability count, say how many of the business’s critical processes currently have no proven path an attacker could use to reach them. Instead of a patch cadence, say how long it takes to close something once it is proven exploitable. This is the same translation the CTEM metrics post works through in detail — that post is where you build the report; this one is about the ten minutes where you present the headline of it.
| Instead of this | Say this |
|---|---|
| “142 open findings, 12 critical” | “Three of our seven critical business processes have no proven attack path today, up from one last quarter” |
| “We rolled out EDR to 98% of endpoints” | “We can detect an attacker on the systems that run payroll and order fulfilment” |
| “Patch SLA compliance: 87%” | “Once something is proven exploitable, it’s closed in a median of 9 days” |
Every row in the right column is a sentence a director can repeat to the CEO the next day. That is the test for whether it belongs in the room.
Two analogies, used sparingly
Analogies earn their place when they compress a real mechanism, not when they flatter the audience. Two hold up under questioning.
The first is the shift from an annual physical to continuous monitoring. Vulnerability management, the thing the board may already believe it is funding, is the once-a-year checkup: a snapshot, useful on the day, stale a month later. CTEM is the continuous version — closer to a wearable that flags a real problem as it develops rather than waiting for the next appointment. Directors who sit on other committees have usually made exactly this trade-off somewhere else in the business, which is what makes the analogy land without needing to be explained twice.
The second is testing the locks, not just installing them. Most security spend to date bought the equivalent of alarms and reinforced doors. CTEM is the ongoing practice of actually trying the doors — safely, on your own building — to find out which ones an intruder could open, rather than assuming that because a control was purchased, it works. This is where you can point at the validation stage specifically without using the word “validation.”
Stop at two. A third analogy is where the presentation starts sounding like a sales pitch instead of a briefing.
The question you cannot dodge
Someone will ask, directly or in a roundabout way, “are we going to get breached.” The honest answer is that you cannot promise no, and a program that implies it can will lose credibility the first time an incident makes the news, in your industry or your supply chain.
The honest version is: no control set removes the risk to zero, exposure management does not change that, what it changes is which processes an attacker can actually reach right now and how fast a proven gap gets closed once it is found. Say that plainly and move to the evidence — the count of critical processes with no proven path, and its trend. A number moving in the right direction is a more convincing answer than a reassurance, and it is one you can defend under follow-up questions.
Resist the urge to soften this with statistics about how rare breaches are for companies your size. It reads as reassurance-shopping, and the one director who has read a headline about a peer company will notice.
What stays out of the room
Board time is the most expensive time in the company. Three things reliably waste it.
Jargon and tool names. “We deployed a new ASM platform integrated with our CAASM” tells the board nothing about risk and everything about vendor relationships they don’t need to evaluate. Say what changed about what you can see or fix, not what you bought.
A wall of CVEs or a severity pie chart. It looks like rigour and reads as noise; nobody in the room can act on it, and it invites exactly the wrong question — “why is that top one still red” — about an item that may not matter.
A promise of zero risk. It is the fastest way to convert a funding conversation into a liability conversation, the moment something eventually goes wrong.
Showing progress without overclaiming
Boards fund trajectories more readily than they fund states. “We are Defined in three of five CTEM stages and Developing in the other two, and our plan moves validation to Defined this year” is a claim you can defend with evidence, and a claim that survives being checked again next year. The CTEM maturity model post lays out what evidence backs each level per stage — bring the weakest stage and the plan to move it, not a single score that hides which parts of the program are still young.
Resist rounding up. A program that is Developing in validation and reports itself as “mature” gets caught out the first time a director asks a specific follow-up question, and the credibility cost is larger than the credit for one good quarter would have been.
This kind of oversight is now an explicit board expectation, not just good practice. The NACD and Internet Security Alliance Director’s Handbook on Cyber-Risk Oversight frames cybersecurity as an enterprise risk issue that warrants dedicated, recurring board time and a defined set of board activities to oversee it — not a once-a-year briefing. A ten-minute slot with a trend line and an honest answer to the breach question is what that oversight looks like in practice, and it is also what keeps you getting invited back.
Next
Build the report this presentation summarises with the only CTEM metrics leadership will read. Use the maturity model to back the trajectory claim with evidence instead of adjectives. If you need to know where your program actually stands before you stand in front of the board, take the assessment first.