For CISOs: from vulnerability list to board-level evidence
Published on June 5, 2026 · Updated on August 4, 2026
For many CISOs, vulnerability management has long since stopped being a technical back room. The question is above all whether the organization demonstrably knows what is online, which risks have priority, who owns remediation and what evidence is available when the board, an auditor, a regulator or a customer asks for it.
This shift is being accelerated by NIS2, the Dutch Cybersecurity Act (Cyberbeveiligingswet) and broader expectations around digital resilience. In its board-level questions for the CISO, the National Cyber Security Centre (NCSC) emphasizes that the conversation is meant as a structural dialogue about risks, execution, measures and trust between the board and the CISO. International guidelines likewise emphasize regular reporting on the cyber security posture, clear responsibilities and insight into critical systems.
For CISOs this means that traditional vulnerability reports fall short. A spreadsheet with hundreds of findings rarely helps to make board-level decisions. What is needed is board-level evidence: traceable, current and reproducible information about the attack surface, the vulnerabilities, the prioritization and the follow-up.
Board-level evidence is the set of facts, measurements, decisions and follow-up information with which a CISO can demonstrate that cyber risks have been found, assessed, prioritized, assigned, followed up and re-validated.
Exposentry supplies the measurement and evidence facts within that set: the finding, the measurement moment and the record. The links of assignment, follow-up and re-validation come from the organization's own process; Exposentry records the facts on which those links rely.
The difference between a list and evidence lies in four properties: the finding is traceable to source and measurement moment, the record is tamper-evident, there is a timeline that shows change, and the reporting is delivered independently of whoever administers your environment. A bare vulnerability list lacks those properties; forensically substantiated evidence and independent reporting add them.
Why the classic vulnerability list is not enough
A vulnerability scan produces valuable technical signals, but such a scan only becomes relevant at board level when the outcomes are connected to business-critical processes, risk appetite, ownership and remediation deadlines. That is exactly where many organizations get stuck. They do know that there are vulnerabilities, but not always whether the overview is complete, whether the right systems are being scanned and whether remediation has actually been verified.
An important cause is that the digital attack surface is constantly changing. Cloud environments, supplier integrations, test environments, domains, APIs, forgotten subdomains and temporary services can emerge faster than the formal asset register is updated.
| Classic reporting | Reporting usable at board level |
|---|---|
| A list of technical vulnerabilities. | A risk picture per asset, process, owner and priority. |
| Snapshot based on known assets. | Continuous monitoring of the external attack surface. |
| Focus on CVSS score or severity label. | Combination of severity, exploitability, exposure, business impact and remediability. |
| Unclear who is responsible for follow-up. | Findings are linked to owner, decision, deadline and re-validation. |
| Limited evidentiary value during an audit or incident. | Recording of what was found and when, traceable and verifiable. |
For a CISO this distinction is essential. In practice a board rarely asks whether "a scan was run"; the question is usually whether the organization demonstrably has a grip on the risks that can affect continuity, confidentiality, integrity and supply chain position.
The CISO as translator between technology and the board
The modern CISO sits between technical reality and board-level decision-making. Directors are expected to understand which critical systems exist, what their value is, where they are located, who has access, how they are protected and how that protection is verified.
This requires a different type of reporting from the CISO. Alongside "what is vulnerable?" also: "why does this matter?", "what choice is on the table?", "what is the residual risk?" and "where is the evidence that the measure works?".
| Board question | Required CISO information | Role of evidence-first monitoring |
|---|---|---|
| What are our crown jewels and where are they exposed? | Overview of domains, IPs, services, cloud components and connected suppliers. | Records what is externally visible and how that picture changes. |
| Which vulnerabilities currently pose the greatest risk? | Prioritization based on severity, exploitability, exposure and business context. | Combines findings with measurable exposure and historical trend. |
| Are teams remediating findings on time? | Ownership, SLAs, exceptions and re-validations. | Shows whether remediation has actually taken place and when. |
| Which risks do we consciously accept? | Decision-making, justification and duration of risk acceptance. | Provides the measurement evidence to periodically reassess exceptions. |
| Can we demonstrate this to an auditor, customer or regulator? | Reproducible evidence, reports and audit trail. | Preserves facts, measurement moments and follow-up in a consistent manner. |
A CISO who has this information structurally available shifts the conversation from isolated incidents to governable cyber resilience.
Evidence-first vulnerability monitoring
Exposentry approaches vulnerability management from evidence-first vulnerability monitoring. This means it revolves around demonstrability. The scan outcome, context, timeline and follow-up together form a file with which the organization can show which risks have been identified and which choices have been made.
This approach fits the direction of the Cybersecurity Act. Under NIS2, essential and important entities must take appropriate and proportionate technical, operational and organizational measures to manage risks to network and information systems. It is about a risk management process in which identifying, analyzing, treating, monitoring and improving follow one another. The Rijksinspectie Digitale Infrastructuur (RDI) emphasizes that risk management is a cycle of identifying, analyzing, evaluating and managing.
For CISOs this creates a practical starting point: every risk found must be traceable to an asset, an owner, a decision, a measure and a verification moment. That chain turns scanning into demonstrable control.
From attack surface to remediation priority
Not every vulnerability deserves the same attention at the same time. A vulnerability on an internal test system without external exposure has a different risk profile than a vulnerable internet-facing service that is part of a critical customer process. An evidence-first approach helps to determine priority based on factual exposure.
In doing so it is useful for a CISO to distinguish four layers. The first layer is asset discovery: what is actually online? The second layer is exposure analysis: which services, ports, configurations and versions are visible? The third layer is risk context: which findings are exploitable, relevant or linked to critical processes? The fourth layer is remediation evidence: has remediation been assigned, carried out and re-validated?
| Layer | Core question | Value at board level |
|---|---|---|
| Asset discovery | Do we know what is externally visible? | Prevents blind spots and shadow IT. |
| Exposure analysis | Which services and configurations increase our risk? | Makes the external risk profile concrete. |
| Risk context | Which findings affect continuity, data or supply chain responsibility? | Supports choices about priority and budget. |
| Remediation evidence | Is remediation demonstrably completed? | Strengthens auditability and management accountability. |
This structure makes vulnerability management more understandable for directors, without losing technical depth. The board must be able to assess whether risks are being managed in the right way.
Which KPIs should a CISO report?
A CISO dashboard should not be overloaded. It must contain stable indicators that the organization can track over time and that align with risk appetite. For Exposentry the emphasis lies above all on the measurability of exposure and remediation; KPIs around ownership and SLAs usually come from the organization's own process, for which Exposentry supplies the measurement facts.
| KPI | What does this measure? | Why relevant for the board? |
|---|---|---|
| Unknown or new internet-facing assets | New domains, subdomains, IPs or services outside the known register. | Shows whether the asset picture is current and complete. |
| Critical findings per risk category | Vulnerabilities, misconfigurations and open services with high priority. | Makes the current risk profile visible. |
| Average time to triage | Time between detection and assessment by the responsible owner. | Measures the organizational response. |
| Average time to remediation | Time between detection and a validated solution. | Shows whether remediation capacity matches risk appetite. |
| Findings outside SLA | Open risks beyond the agreed deadline. | Gives the board concrete escalation material. |
| Reopened findings | Vulnerabilities that recur after a previous solution. | Signals structural process or configuration problems. |
| Evidence coverage | Percentage of findings with a demonstrable scan, decision, owner and re-validation. | Underpins auditability and regulatory readiness. |
A good CISO dashboard is therefore a steering instrument. It shows where risks arise, where remediation stalls and which decisions are needed.
How Exposentry helps the CISO
Exposentry is the measurement and evidence layer within that broader process. It combines continuous vulnerability monitoring based on OpenKAT (the open-source scanner of the Dutch government, to which Exposentry founder Edward Hasekamp contributes as a collaborator) with a record of every measurement. This produces a way of working that fits CISOs who want to go beyond periodic scanning and be demonstrably in control.
The value sits in three places. Exposentry makes the external attack surface visible and reduces blind spots. It supports risk-based prioritization, so teams work on the issues that really matter. And it delivers tamper-evident reports: in production, reports are digitally signed (PAdES) and stamped with an independent RFC3161 timestamp (signing errors do not block delivery), and they are delivered independently of whoever administers your environment. This makes it verifiable afterwards what was measured and when, and puts the CISO in a stronger position towards the board, an auditor, a customer or a regulator.
NIS2 compliance remains a broader board-level and organizational task; within it, evidence-first monitoring provides one important building block: current, verifiable facts about exposure, vulnerabilities and remediation. Without those facts, governance remains abstract. Read more about this distinction in scanning is not NIS2 compliance.
Conclusion
Today's CISO is held accountable not only for technical detection, but for demonstrable control. Directors typically want to know whether the organization knows its digital crown jewels, whether risks are followed up in time, whether suppliers and external services are in view and whether choices are defensible.
That is why vulnerability management must shift from a list of findings to board-level evidence. Evidence-first vulnerability monitoring makes visible what has been found, why it matters, who is responsible, which measure has been taken and whether remediation has been confirmed. For CISOs that is the shortest route from technical signals to governable cyber resilience. How to practically filter and present those signals is covered in from CVE list to board report. And what auditors and insurers expect from that evidence is in forensically substantiated evidence.
Get started
As a CISO, do you want demonstrable control over vulnerabilities and attack surface? Check the plans and pricing or start straight away with a first scan.
Sources
- NCSC, "Vragen die je als bestuurder kunt stellen aan de CISO": ncsc.nl
- Australian Signals Directorate / ACSC, "Guidelines for cyber security roles": cyber.gov.au
- Palo Alto Networks, "A CISO's Guide to Attack Surface Management": paloaltonetworks.com
- Deloitte, "The CISO Brief: The what, when, and how of effective board communication": deloitte.com
- EUR-Lex, Directive (EU) 2022/2555, Article 21: eur-lex.europa.eu
- Rijksinspectie Digitale Infrastructuur, "Risicomanagement en cyberbeveiliging": rdi.nl
Written by Edward Hasekamp, founder of Exposentry and collaborator on the open-source OpenKAT project. See the project on GitHub and the profile at github.com/hasecon. Exposentry provides EU-sovereign, forensically substantiated vulnerability monitoring based on OpenKAT. More articles in the Knowledge base.