Traffic-light cyber slides had a good run. They were easy to print, easy to ignore, and excellent at creating the feeling of oversight without the discomfort of choosing. Boards that have lived through a real incident are less patient with that comfort now.
Better briefings look like decision memos: what could knock us offline, what it would cost, what we already funded, and what we are consciously deferring. Colour coding can stay as a summary. It should not be the argument.
| Board question | Weak answer | Useful answer |
|---|---|---|
| Are we secure? | “Mostly green” | Top three residual risks with owners |
| What did we buy? | Tool logos | Controls tied to scenarios |
| If we are hit? | “We have a plan” | Last tabletop date and gaps found |
Directors do not need to become engineers. They do need to stop mistaking a colourful dashboard for a strategy.
Seen up close, the pattern is less about breakthrough theatre and more about quieter competence: fewer surprises, clearer owners, and tools that survive contact with Tuesday afternoon.
The best briefings end with a decision, even if the decision is “accept this risk until Q4.” Silence after a green slide is how surprises get scheduled.