The Executive Session: Cyber Time Without Management in the Room

The CISO finishes the presentation, asks if there are questions, and receives the usual polite two. The meeting moves on. Nobody asked the real question - the one that starts with 'are we actually' - because management was sitting right there.

This is not a character flaw in anyone. It is how rooms work. Directors soften questions in front of the people who own the answers, and management, hearing only soft questions, concludes the board is satisfied.

A standing executive session - directors and, by invitation, the CISO without their leadership chain - changes the signal both directions.

TLDR

• Directors ask different questions when the full management team is not in the room.

• A twice-yearly cyber executive session is enough to change the information flow.

• Set the rules first: it is for candor, not ambush; themes go back, names do not.

• Give the CISO direct access to the board outside the reporting line.

• Use what surfaces: recurring themes in executive sessions are agenda items.

What the room suppresses

In the full meeting, directors calibrate: is this question naive, does it undermine the CISO, will it burn ten minutes of a tight agenda. So the question that would have revealed the most - the one about whether the dashboard is believed - goes unasked.

Management calibrates too. Bad news is rounded off, uncertainty is presented as a plan, and the gap between the slide and reality stays private. Everyone behaves reasonably, and the board ends up less informed than anyone intended.

Design the session for candor

Twice a year is enough. Put it on the calendar as a standing item so it is routine, not a signal of alarm. Common formats: directors alone for fifteen minutes, or directors with the CISO present but the CEO's direct reports absent.

Set the ground rules out loud the first time. The session exists to improve oversight, not to build a case. What comes back to management is themes and requests - 'the board wants a clearer view of exception aging' - not transcripts or attribution. A CISO who gets burned once by attribution will never be candid in that room again.

What surfaces

This fictional example shows themes a board collected over two sessions. It is an illustration, not a real record.

Theme raised	What the board did with it
Directors unsure which metrics reflect real exposure	Asked for a decision-focused reporting redesign
Concern that incident learning does not reach the board	Added an incident-review slot to the calendar
Questions about security team capacity	Sponsored an outside benchmark review

Notice the pattern: nothing scandalous, everything actionable. Executive sessions rarely uncover secrets. They surface the questions the full room was too polite to spend time on - which turn out to be the useful ones.

The CISO access line

Pair the session with a standing norm: the CISO can reach the audit chair directly, without routing through the CEO. It is used rarely and matters enormously - it is the channel for the day the CISO's judgment and their boss's preference diverge on something material.

Governance guidance, including NIST's framework, treats independent oversight and clear reporting lines as structural, not personal. The executive session and the access line are the structure; candor is what they buy.

The related discussion of cybersecurity governance for boards is worth your time alongside this one.

Frequently asked questions

Will the CEO see this as going around them?

Framed as a standard oversight practice and announced in advance, most CEOs accept it quickly - many welcome sharper board engagement. Springing it mid-meeting is what creates the political problem.

Should the CISO attend or not?

Both formats work. Directors-alone surfaces concerns about the program's direction; directors-with-CISO surfaces the CISO's real view, uncushioned by their chain. Alternate them across the year.

What if nothing surfaces?

That is information too - but give it two sessions. The first is often polite; candor arrives once directors trust the rules about attribution.

A Defensible Next Step

Put a fifteen-minute executive session on the next two board agendas, with the ground rules read out first. What surfaces in the second one will be the agenda your oversight was missing. Book a Decision-Clarity Call if you want help framing it.