What belongs in a cybersecurity board report on external threats

When a board slide fails, it’s usually because the numbers are wrong. The external threats slide fails the other way around. The numbers are accurate, the work behind them was real, and nobody in the room knows what to do with any of it.

You put up a count of phishing domains detected last quarter. A director asks whether that’s good or bad. There’s no answer, because a count of findings says nothing about whether anything came down, came back, or touched a customer.

That silence costs you the ask. This is the section carrying a budget request, an owner for escalation, or a gap you need the board to formally accept. None of those survive a slide the room can’t interpret.

Why the external section is the one nobody has a template for

Every other part of a cybersecurity board report covers systems your company owns. Endpoints, identity, third-party access, backup and recovery all sit inside a boundary somebody can audit. This section covers everything carrying your name outside that boundary, which is a different problem and doesn’t fit the same reporting furniture.

The standard templates reflect that. The National Association of Corporate Directors publishes a cyber-risk handbook toolkit with the Internet Security Alliance, and its board dashboard tracks quarter-on-quarter movement across exposure, resilience, hygiene, third party, culture, and data security. No row covers hostile infrastructure standing up outside the company.

So it gets built from a blank page each quarter, usually by borrowing the internal security operations report’s format. That’s the first mistake, because the two measure different things. The operations report measures what your team did. This one has to measure what’s true outside your perimeter, so it has to be built on the enforcement itself. Bolster AI tracks takedown status against the infrastructure it found rather than against the tickets your team closed, and that difference is the whole of this article.

What actually happens between a detection and a removal

Walk the sequence once, because the board question you can’t answer sits in the middle of it.

• A domain gets registered. Somebody buys a near-miss of your name at 2 am, often through a registrar chosen because it’s slow to answer abuse mail.

• Content goes up, then traffic gets pushed at it. A copy of your sign-in page, then an ad, an SMS, or a social account pointing customers at it. The page is worthless until somebody drives traffic, so the two arrive together.

• Your team finds it. From monitoring, or because a customer forwarded a screenshot to support.

• Somebody assembles evidence and submits a report. To the registrar, the host, the platform, or the ad network, each with its own format, abuse contact, and appetite for acting.

• Somebody who doesn’t work for you decides. This is the step that matters, and the one you have least to say about. The page goes dark, or it doesn’t, or it does in four days.

• The operator re-registers. New name, same template, often the same hosting. Getting a takedown done the hard way means discovering the work restarts a week later.

Six steps. The two that decide the outcome happen at companies you have no relationship with.

Your tools log your own actions, not the outcome

Every system you’d normally pull board numbers from is pointed inward. Your SIEM, your endpoint agents, your ticketing queue, and your identity logs record events on infrastructure you control, which is what makes them trustworthy for the rest of the deck.

The fake sign-in page isn’t on your infrastructure. So your logs stay clean while the campaign runs, and the only thing your stack records is the portion your own team performed: the alert that fired, the ticket that opened, the report that went out. Whether the page came down is an event at a registrar. Whether it came back is an event next month. Whether a customer typed their password into it is an event you’ll hear about only if they tell you.

The Anti-Phishing Working Group counted 3.8 million phishing attacks across 2025, up slightly from 3.76 million the year before. A global figure that barely moved tells a director nothing about your own exposure, and your tooling can only tell them what your team did about it.

That distance is the whole problem.

The five lines a director can actually use

Directors don’t have room to become external threat analysts, so the useful version is short. Five lines carry it, and each is a standard worth holding your reporting to rather than a metric to collect.

Exposure, grouped by who can remove it. State what’s live carrying your name and roughly how many people it can reach, then group it by removal path, because the path is what actually differs. Lookalike and spoofed domains go to a registrar or a hosting provider. Impersonation of the brand and of named executives goes to the platform. Apps go to an app store, ads go to an ad network, and exposed credentials go nowhere, because there’s nothing to take down.

The hard part here is coverage, not formatting. A tool watching one surface produces a one-surface slide, and the board reads a fraction of your exposure as the whole of it. Bolster AI covers domains, social accounts, apps, ads, and marketplaces together, so the line adds up.

Movement, reported as campaigns rather than counts. Give the direction against your own prior quarter, not a raw total, because a total rises when attacker volume rises and rises again when you buy better detection. Then name the campaign behind it. One operator often runs the fake domain, the ad pushing traffic to it, and the account vouching for it, so a board showing three numbers sees three problems. Bolster AI connects that related infrastructure into a single campaign through Signals, so the trend you show tracks operators rather than artifacts.

Time to removal, confirmed by whoever removed it, with what came back. Report requests you sent and removals somebody else confirmed are two separate numbers, because only the second is evidence. State what share of everything you found was acted on at all, because that denominator is the one nobody volunteers.

A confirmation is worth what the relationship behind it is worth. Bolster AI holds direct API partnerships with over 1,500 registries and hosting providers, which is what turns an assumed number into a confirmed one, and it keeps watching sites, accounts, and apps afterward. A removal that reappears next week under a new address was a delay, not a result.

Customer impact, sourced from customers. Say who was actually approached, how you know, and what it cost. Verizon’s 2026 Data Breach Investigations Report puts the human element at 62% of breaches, using Verizon’s own definition of that category. Your customers aren’t in that denominator, and that’s the argument for this line: nobody counts them on your behalf, so the only honest source is what they tell you. What arrived in Bolster AI’s Customer Abuse Mailbox is evidence. Impact inferred from attacker volume isn’t.

What changed, and where the numbers came from. Close with the coverage, process, or budget change the four lines above argue for. If producing them costs a week of manual assembly, the reporting costs more than it returns, so Bolster AI puts them on one dashboard security, fraud, and support teams all read from.

Where the numbers usually come from, and why they don’t hold up

Four sources supply most external board slides, and each answers a question the board isn’t asking.

The SIEM or ticketing export. It records your team’s actions. A ticket closes when an analyst closes it, not when the page comes down, so “resolved” quietly means the work stopped.

The detection vendor’s dashboard. It counts findings, and a rising count could mean a worse quarter or a better sensor. A director can’t tell those apart, and nothing in it confirms a single removal.

The spreadsheet rebuilt each quarter. Assembled by hand from three teams, so definitions drift between cycles and nobody can defend the denominator when a director checks it.

The inbox of confirmation emails. These are the only real evidence you have, and they’re sitting in four individual mailboxes, silent on recurrence, and impossible to turn into a trend.

The problem isn’t that any one of them is bad. It’s that they’re one system split four ways, and the splits fall where the board’s questions live. Producing all five lines takes one thing that finds the infrastructure, submits evidence in the format each registrar wants, holds the relationships that get a confirmation back, links related impersonation into one campaign, and keeps watching after the page goes dark. That combination is what Bolster AI is, and it’s why the report stops being a quarterly reconstruction project.

Building the external threats section with Bolster AI

Bolster AI detects external threats including phishing sites, lookalike domains, fraudulent social accounts, fake mobile apps, fraudulent ads, and marketplace abuse, connects related infrastructure into a single campaign, and removes them. Detection and takedown run as one workflow rather than as two separate promises, with automation carrying the volume and Bolster AI analysts handling the cases that need judgment. That single workflow is what makes the reporting possible.

One exposure line with the removal path already attached. Bolster AI covers domains, social accounts, mobile apps, fraudulent ads, and marketplace listings as separate surfaces with separate enforcement routes, which is the same split the board line needs. The slide writes itself in the order a director reads it.

Action time and removal time kept apart. Bolster AI publishes a 60-second mean time to response. That’s how fast Bolster AI acts on a confirmed threat, not how fast a registrar acts, and Bolster AI publishes its own action time rather than a removal time precisely because the removal clock belongs to somebody else. Report yours the same way, and a slow quarter reads as a slow registrar, not a slow team.

Recurrence as a standing number. Bolster AI keeps watching after the removal, so “came back” becomes a figure you carry into the next meeting rather than an anecdote an analyst half-remembers. Recurrence is a number, not a feeling.

Proof that survives a follow-up. Bolster AI reports that SoFi cut analyst workload by 20% and shut down an international phishing campaign in 24 hours. Numbers like those belong in the “what changed” line, because they describe a program improving rather than a threat landscape worsening.

What Bolster AI won’t tell you. It can’t give you a complete victim count. Nothing can, because the customers who were approached and never said anything leave no record, and any vendor offering that number is offering an estimate wearing a decimal point. What Bolster AI can report is what was live, what was removed and confirmed, what reappeared, and what customers sent in. Claim more, and one skeptical director is enough to find it.

None of this replaces the security operations report or the risk register. Those cover the systems you own, and they should. What makes Bolster AI different is that it takes the other half of the picture starting the moment your name shows up on infrastructure you don’t own.

Build the section once, then let it run

The external threats section isn’t a writing problem. It’s a question of whether anything in your stack is positioned to know what a registrar decided, what a platform removed, and what came back. Those are the only answers a director can govern with, and Bolster AI produces them as a byproduct of the enforcement rather than as a quarterly exercise.

Right now the exposure line, the removal confirmations, the recurrence count, and the customer reports probably live in four places and get stitched together the week before the meeting. See what the section reads like when every line comes off the system that did the enforcement.

TL;DR: The external threats section of a cybersecurity board report needs five lines. What hostile infrastructure is live carrying your name, which way that moved against your own prior quarter, how long it stayed up before somebody confirmed it was gone, how much of it came back, and what reached customers. Most teams cannot produce those lines, because their tooling records what their own team did rather than what a registrar or a platform decided. Report requests sent and removals confirmed as two separate numbers, state the denominator, and track what reappears after the takedown. Leave out alert queues, tool names, and anything a director cannot act on. Bolster AI produces the exposure, movement, removal, and recurrence lines off one surface, plus the customer evidence behind the fifth, because it runs detection, submission, confirmation, and post-takedown monitoring as a single workflow.

Frequently asked questions

What should the external threats section of a cybersecurity board report contain?

Five lines: live exposure grouped by who can remove it, movement against your own prior quarter, time to removal measured to a confirmation, how much infrastructure reappeared, and what reached customers. Close with the decision you want, usually funding coverage, naming an owner for escalation, or formally accepting a gap. Leave out alert queues, scan counts, and tool names.

How often should external threats go to the board?

Most programs run a short standing brief at every board meeting and a longer quarterly session for mechanism and strategy. Keep the brief to a trend line and a few sentences, because a two-page limit forces you to decide what genuinely changed rather than list what happened. Save how a campaign worked for the deep dive.

Should we report takedown requests or confirmed removals?

Both, as two separate numbers, and never added together. A request you sent is an action your team took. A confirmation from the host or registrar is evidence the page is gone. State what share of everything you found was acted on, because a program that only submits the easy cases will otherwise post a flattering rate.

Why can’t our existing security tools produce these numbers?

Because they’re pointed at infrastructure you own, and the hostile infrastructure isn’t. Your SIEM can record that your analyst filed a report. It can’t record that a registrar suspended the domain nine hours later, or that the operator registered a replacement on Tuesday. Those events happen at other companies, which is why Bolster AI holds the registrar and host relationships that send a confirmation back.

Can Bolster AI tell us how many customers were hit by a phishing campaign?

No. Bolster AI can tell you what infrastructure was live, how long it stayed up, what was confirmed removed, what came back, and what customers reported to your abuse mailbox. A complete victim count would mean knowing about the people who were approached and never told anyone, and no external platform has that. Treat any vendor who offers it as a vendor to question harder.

Does Bolster AI produce board reporting directly?

Not as a slide generator, no. What Bolster AI gives security, fraud, and customer support teams is a single view covering detection, takedown status, and recurrence, so the five lines come out of the system that did the enforcement rather than out of a quarterly spreadsheet exercise. Bolster AI reports campaign-level rollups rather than raw alert counts, which is the level a board can act on.