After a near-miss or confirmed incident, boards rarely want a technology lecture. They ask whether customer data was involved, whether operations can continue, and who is accountable for the next actions.
Bring a single timeline with detection, containment, and notification milestones. Avoid packing every log source into the deck; keep the evidence pack ready if someone asks for depth.
Be honest about unknowns. Directors notice when confidence language exceeds what the SOC can verify. A clear ‘still investigating’ line earns more trust than a polished guess.
Close with decisions you need from them: budget for overtime, approval to notify a regulator, or authority to pause a product launch. Briefings that end without a request waste the room.