The Board's Thank-You: Recognizing the People Who Carried the Risk

It is Thanksgiving, and the year's cyber record at most organizations reads like a non-event: no headline breach, no public failure, no frantic weekend that made the news. That quiet was not an accident. Somebody's work made it.

Boards are good at engaging after things go wrong. The quieter governance skill is noticing, out loud, the people whose work meant there was nothing to engage about.

Key takeaways

• A quiet year in security was made, not given. Somebody's unglamorous work produced it.

• Recognition from the board is a governance act, not a courtesy.

• Thank the outcomes and the habits: the patch cycles, the drills, the unpopular holds.

• Ask what the quiet year cost the team; sustained vigilance has a price.

• The best follow-up to thanks is the question: what do you need next year?

Step 1: Notice what the quiet year contained

Before thanking anyone, learn what the year actually asked of them. The patch cycles finished on time, the phishing tests that made nobody popular, the vendor questionnaire answered at 9 p.m., the drill run on a Friday afternoon, the hold put on a launch the business wanted.

Recognition that names the work lands. A generic "great job on cybersecurity" tells the team the board was not watching, which is worse than silence.

Step 2: Say it where it counts

A line in the board minutes recognizing the year's security work takes two minutes and is read by exactly the people who matter. A note from the chair to the security lead and their team takes ten. Both outlast the holiday.

This fictional example shows the minute. It is an illustration, not a prescription.

Three sentences. The third is the one most boards skip.

Step 3: Ask what the quiet cost

Vigilance has a price: the on-call weekends, the coverage gaps, the work deferred because the team is one person smaller than the job. A board that asks the question hears about burnout while it is still a staffing conversation rather than a resignation letter.

The security champions piece covers one way to spread the load beyond the security team itself.

Step 4: Turn gratitude into next year's mandate

The strongest form of thanks is the question "what do you need next year, and what should we stop asking of you?" That is the beginning of next year's expectations conversation, and it means the quiet year bought the team something more than a compliment.

Frequently asked questions

Is a thank-you really a board matter?

Retention of the people who carry your risk is absolutely a board matter. Security staff who feel seen stay; staff who feel invisible update their resumes. A minute in the record and a question about next year are cheap retention.

What if the year was not actually quiet?

Then the recognition is for the response, not the silence: the incident handled well, the recovery that held. Honest recognition of hard work beats pretending the year was easy.

Should recognition come with budget?

The ask-first approach usually surfaces what actually matters, which is often staffing or tooling rather than money alone. Let the team's answer shape the budget conversation instead of guessing.

When should this happen?

Before the year closes, while the work is fresh. Thanksgiving week is as good a prompt as any, and better than the rushed December meeting where it would be item nine.

A Defensible Next Step

At the last meeting of the year, put three sentences in the minutes and one question to the security lead: what do you need next year? Book a Decision-Clarity Call if you want help turning the answer into next year's plan.