Skip to content
Indene
en

NotíciasIn the press

Gartner Recommends CISOs Report Cyber Risk in Financial Terms

Gartner advises CISOs to replace technical dashboards with financial statements when reporting cyber risk to the board. With 93% of board members viewing cyber risk as a threat to company value, quantifying exposure in financial terms is no longer a trend but a requirement, driven by regulations like NIS2 and DORA.

2 min read

Curva de perda assimétrica em traço fino sobre fundo claro, com o pico marcado em verde e a cauda longa à direita, e o título Cyber risk, read as a balance sheet.
Curva de perda assimétrica em traço fino sobre fundo claro, com o pico marcado em verde e a cauda longa à direita, e o título Cyber risk, read as a balance sheet.

The way companies present information security to senior management is changing. At the Security & Risk Management Summit 2026, Gartner analysts Sam Olyaei and Tom Scholtz recommended that CISOs move away from technical dashboards and start reporting cyber risk in the same format that the board already uses for decision-making: financial statements.

The Problem: Security Speaking a Language the Board Doesn't Use

Figures show that the topic is already on board agendas:

  • 93% of board members agree that cyber risk threatens shareholder value;
  • 98% believe that threats will increase in the next two years;
  • almost all security leaders now report directly to the board, compared to about 25% a decade ago.

Nevertheless, most security reports are still organized around technical areas, with vulnerability counts, maturity indices, and alerts. Scholtz summarized it this way: "Many reports are structured around cybersecurity, not around the business."

The Proposal: Cyber Risk in Three Statements

Gartner suggests organizing security reporting into three views inspired by accounting:

Statement What it shows in security
Balance Sheet Snapshot of current risk exposure, with estimated financial impact
Income Statement Financial effect of threats and security improvements
Cash Flow Statement Where security investments go, by category and year-over-year

The recommendation also includes maintaining the same metrics from one quarter to the next, so the board can track progress and decide where to invest based on trends, not isolated snapshots.

Risk Quantification is No Longer a Trend, It's a Requirement

Just weeks after the event, Gartner published the report Innovation Insight for Cyber Risk Quantification. For the FAIR Institute, the document ends the discussion about whether it is possible to quantify cyber risk. The question now is how to do it continuously, linked to real operational data and not just periodic reports.

Several factors are accelerating this change:

  • Regulation: requirements such as NIS2 and DORA in Europe and SEC disclosure rules in the US demand that companies demonstrate materiality and resilience;
  • Methodology Adoption: the use or intention to use the FAIR model increased from 46% in 2025 to 58% in 2026;
  • Expanding Market: cyber risk quantification solutions are expected to grow from US$340 million (2024) to approximately US$900 million by 2033.

What This Means for Companies

Information security is now treated as a business risk. Companies that can translate cyber exposure into financial values can also justify investment, prioritize what truly matters, and communicate with the board on equal terms.

In this scenario, measuring risk in financial terms is what separates a company that reacts to incidents from one that makes decisions based on data.

References

Topics

Keep reading

All news