The Question Every Board Should Ask After a Security Incident

Post-incident reviews often focus on what failed. The better question is whether leadership understood its risk posture before the incident occurred.