Boards usually ask about security after something goes wrong. I’ve sat through enough of these conversations to recognize the pattern. They ask what failed, which control didn’t work or how an attacker got in. Those are fair questions, but they often come too late.