Tell your CFO and board that a zero day is a flaw attackers can use before a fix exists, so the protection is not prevention but speed: how fast you learn, decide and respond. Then show four things: what you run, who can act, how fast you did last time, and what it costs to improve.
What does the board need to hear?
Not the technical detail. They need to know whether the company is exposed to a risk it cannot control, whether management has a plan, and whether the plan is tested. NIST defines a zero-day attack as one that exploits a previously unknown hardware, firmware or software vulnerability. Say it that simply, then move on to what you do about it.
Avoid fear. A calm, specific account earns more trust than a scary one. Do not predict when a zero day will hit you. Nobody can, and a board that hears a prediction will hold you to it.
Four questions to answer on one page
- What do we run? Say how many applications and critical services you operate, and whether you can list the software components in each. Report the result of a real test: "We asked which services use a given library and had the answer in X minutes."
- Who decides? Name the person who may switch off a feature or take a service offline during an emergency, and the backup. Boards like clarity on authority.
- How fast are we? Use a past event. "When a widely reported flaw affected our stack, we identified exposed services in this much time and fixed them in this much time." If you have no past event, run a rehearsal and report that instead.
- What would speed look like? Describe one or two investments, the problem each solves and a range of cost based on quotes.
How do you talk about money?
Do not quote industry averages for breach costs unless you can cite a source for your sector and region. Boards remember numbers, and a number you cannot defend becomes a liability.
Use your own data: hours spent on the last event, the services that carry revenue, contract duties that run on a clock, such as customer notice windows. Present cost as drivers and ranges: tooling, on call time, testing, and disruption from mitigations.
How do you describe residual risk?
Be honest. Even a good program cannot stop an attack that uses an unknown flaw. It can limit blast radius with narrow permissions, segmentation and logging, and it can shorten the time between learning and fixing. NIST SP 800-61 Rev. 3 presents incident response as part of overall risk management, so you can tell the board response capability is a standing part of the program.
Show which known flaws are the bigger daily risk. CISA's Known Exploited Vulnerabilities catalog lists flaws seen exploited in the wild, and most are not zero days. Patching those quickly is cheaper protection than anything exotic.
What metrics fit on a dashboard?
Choose three. Time to identify affected services after a new advisory. Time to mitigate or patch, split by whether the flaw was exploited. Share of services with a current software inventory. Report trends, not single snapshots.
A constructed one page summary
This is a constructed example. "We run twenty services. Eighteen have a current component inventory. In our last rehearsal we found affected services in twelve minutes and agreed a mitigation in ten more. Our gap is two services without inventory and a four hour wait for approval to change production. We propose to close both within the quarter and rehearse again."
That is five sentences and covers all four questions.
What mistakes should you avoid?
Using jargon without a plain gloss. Promising prevention. Quoting a breach cost with no source. Burying the ask. Presenting only tools and not decisions.
Where Safeguard fits
Safeguard covers software side capabilities relevant to the speed story: zero day discovery, reachability analysis to show which services are truly exposed, and autonomous remediation that opens fix pull requests, off by default with categories starting on Manual.
What to do
- Run an inventory test and a rehearsal before the meeting.
- Name the decision maker and backup.
- Write the one page summary with the four questions.
- Use your own hours and ranges for cost.
- State residual risk honestly.
- Report three trend metrics each quarter.
Quick check
How do I explain a zero day in one sentence?
It is a flaw that attackers can use before the vendor has a fix, so what matters is how quickly we learn about it and respond.
Should I cite breach cost averages to the board?
Only with a source suited to your sector and region. Otherwise use your own data on hours, services and contract duties.
Sources
Last reviewed: 18 October 2026.
