The Uncomfortable Truth About Your Board
Let me be direct. Most organizations have a board competency gap, and it is growing faster than people want to admit.
Look at who is joining boards. New S&P 500 directors in 2025 averaged 59.1 years old, and 59% of them were retired, according to Spencer Stuart’s 2025 U.S. Board Index. Thirty percent were active or retired CEOs and 29% had a financial background. Only 11% were 50 or younger. These are smart, accomplished people. Most of them did not come up through a world of AI models, zero trust architectures, or nation-state cyber threats.
That is not a knock on them. It is a structural problem. Boards were built for financial and regulatory oversight, and the risk landscape has moved to technology-first threats. The governance model has not kept pace with what actually threatens the business.
Regulators have noticed. The SEC’s 2023 cybersecurity rules require public companies to disclose a material cyber incident within four business days of determining it is material. They also require annual descriptions of board-level cyber oversight. The EU AI Act adds compliance demands that need real board-level understanding. “We rely on management” is no longer a good enough answer.
So where does the gap hurt most? Three areas.
Three Domains Where the Board Competency Gap Is Most Dangerous
AI Governance: You Cannot Oversee What You Cannot Question
AI is not just another tech tool. It brings risks most boards have never dealt with: hallucination, algorithmic bias, IP contamination, and autonomous decisions made without human review. These are daily realities for any company deploying generative AI at scale.
Take the questions a director should be able to ask. What training data did you use? Who checked the outputs? What happens when the model is wrong and nobody catches it? A board that cannot ask those questions cannot oversee the answers. If you want a deeper look at how leaders should approach AI beyond the hype, I wrote about that in AI strategy for business leaders.
The NIST AI Risk Management Framework is a solid starting point. But a framework only works when someone at the governance level understands why it matters. Otherwise it sits in a binder no one reads. That is the core of the board competency gap in AI.
Cyber Risk: A Multimillion-Dollar Problem Your Board Cannot Delegate
The average cost of a data breach hit $4.88 million in 2024, per IBM’s Cost of a Data Breach report. In healthcare it was $9.77 million. The bigger cost is operational paralysis.
Consider the Change Healthcare attack in February 2024. It disrupted claims and payment processing across the U.S. health system. UnitedHealth Group reported $872 million in unfavorable cyberattack effects in the first quarter of 2024 alone. That is not an “IT issue.” That is a board-level question about risk awareness.
The SEC’s case against SolarWinds and its CISO showed how aggressively regulators were willing to push on cyber disclosure. The agency dismissed that case in November 2025, but the lesson for directors stands. Disclosure rules still apply, and “the CISO handles it” will not hold up if oversight is only for show. Treating cyber as a line item in the IT budget is over.
Digital Transformation: Boards Approve What They Cannot Challenge
Boards routinely approve multi-year transformation budgets. Cloud migration. ERP upgrades. Data platform builds. Most lack the technical fluency to judge whether the strategy is sound or the execution is on track.
So they govern by PowerPoint. Green, yellow, red dashboards that hide reality until a project is too far gone. That is how an organization ends up years behind on an ERP migration with nobody in the room who knew which questions to ask. The gap in transformation oversight is one of the costliest blind spots in business. For the data challenges that feed these failures, see my piece on wrangling enterprise data.
The Committee Trap: Adding Process Without Closing the Board Competency Gap
Some boards have created technology or cyber committees. That is a step forward, but it can also create a false sense of safety.
If you staff the technology committee with the same directors who lack technical fluency, you have added process without adding skill. If the committee works in a silo, cut off from audit, risk, and strategy, you have just moved the blind spot to a new room.
The real need is technology literacy across the entire board. Not delegated. Embedded.
What CxOs Should Actually Do About the Board Competency Gap
Stop Briefing and Start Educating
If your board does not understand what you are telling them, that is partly your problem. I say this as someone who leads 34 engineers across networking, security, datacenter, and AI. I have sat in rooms where governance bodies approved decisions they did not fully understand. The downstream results land on my team.
The CTO role is not just reporting. It is building capacity. Run tabletop exercises with a ransomware scenario. Hold technology deep dives outside the formal meeting. Give directors a chance to ask basic questions without an audience.
Translate tech risk into business outcomes. A director may not care about your firewall setup. They will care when you frame it this way: “If this fails, we lose $5 million in revenue and face SEC disclosure within four business days.” Make the risk tangible. For more on high-stakes calls, see my guide on executive decision making under pressure.
Push for Board Composition That Matches the Threat Landscape
If a board has three former CFOs and zero technologists, its governance will skew toward financial risk. That is human nature. Technology risk gets underweighted at exactly the wrong time.
Nominating committees need to treat AI, cyber, and digital fluency with the same urgency as financial audit expertise. Eighty percent of S&P 500 boards now disclose a director skills matrix, per the same Spencer Stuart index. Ask where technology sits on yours, and whether the box is checked by someone who has actually run production systems.
There is a real difference between a director who “gets digital” and one who has governed production systems. Help your CEO and nominating committee see it. Advocate for sitting or former CTOs, CISOs, and chief data officers, not just executives who are “digitally curious.”
Build a Governance Operating Model, Not Just a Reporting Cadence
Most board engagement feels staged. Sanitize the bad news, build the deck, survive the questions. Flip it. Use board engagement as leverage.
First, define what the board needs to know, when, and in what format. Second, create decision frameworks that allow informed oversight without micromanagement. Third, weave technology risk into enterprise risk management as a core element, not an appendix.
A board that understands your cyber posture will back your budget request. A board that understands AI risk will not force reckless adoption timelines. Education is not a chore. It is a strategic investment.
The Federal and Defense Dimension
In the federal space the problem is amplified. I work with federal and military customers daily through our SDVOSB. The stakes are higher: national security, critical infrastructure, citizen data, mission continuity.
Governance is also more fragmented. Agency leadership, congressional oversight, inspectors general, and contracting officers all play a role. CMMC 2.0, FedRAMP authorization, and Zero Trust mandates all require oversight bodies that can evaluate actual security posture, not just compliance checkboxes.
When the people approving architecture choices cannot tell compliance theater from genuine resilience, the mission is at risk. For more on federal AI readiness, see my post on empowering federal agencies with AI agents.
The Window Is Closing on the Board Competency Gap
AI adoption is speeding up. Cyber threats are getting more sophisticated. Regulatory pressure keeps rising. Boards cannot afford a slow, multi-year “journey” to competency.
Every quarter of delay adds exposure: regulatory penalties, breach liability, failed transformation spending, competitive irrelevance. The boards that act now will govern well. The ones that do not will learn in headlines and courtrooms.
Here is my challenge to every CxO reading this. Make an honest assessment. Can your board be built up through education, or does it need new composition? Both are valid paths, but they need different strategies and different timelines.
Stop waiting. Your directors cannot govern what they do not understand, and it falls on you to close that gap.
