As with any other aspect of operating a business, effectively managing cyberrisk is predicated on making well-informed decisions and then executing reliably within the context of those decisions. With that in mind, boards and senior executives must ensure that their organizations accomplish both. For the reasons described below, today many organizations are unable to do either.

There are two primary components to making well-informed decisions regarding a complex and dynamic risk landscape — visibility and analysis — and executive management must examine both.