A board or executive team does not need a list of vulnerabilities -- they need to know what could stop the business from operating, what it would cost, and what decision is being asked of them.
Lead with consequence, not technical detail
State the top operational exposure in plain terms: what could happen, to what system, with what consequence -- before any technical explanation of how.
Show trend, not just a snapshot
Is your risk posture improving, stable, or degrading since the last report? A single point-in-time number without trend context is hard for leadership to act on.
Separate 'informational' from 'decision required'
Make it explicit when you are simply informing leadership of an accepted risk versus when you are requesting a decision -- budget approval, formal risk acceptance, or awareness of a material exposure.
Tie every ask to a specific outcome
Budget requests should map directly to a named risk reduction, not a generic 'improve security posture' line item that is difficult to evaluate or hold accountable.
Match cadence to volatility
A stable environment can report quarterly. A facility undergoing major change -- re-architecture, new vendor onboarding, recent incident recovery -- needs tighter reporting exactly because that is when new exposure is most likely to appear unnoticed.