The incident is contained. You have 10 minutes with the board next week. The technical picture is still incomplete and attribution is unresolved. What do you present?

Ten minutes with a board means roughly three things, said clearly, with the decision at the front.

I would open with impact and status: what happened in one sentence, what it affected, that it is contained, and what the residual risk is right now. A board's first question is always "are we still exposed", and answering it before they ask buys the rest of the ten minutes.

Then the decision I need from them. If the answer is more investment in a specific control, or accepting a residual risk, or approving a disclosure position, that goes second, not last. Boards are a decision-making body and a briefing without a decision in it is a status update they did not need to attend.

Then the honest uncertainty. I would say plainly that attribution is unresolved and that I am not going to speculate, and — this is the part that matters — explain why it does not change the decision in front of them. Whether this was a criminal group or something else, the control gaps are the same and the remediation is the same. If it did change the decision, for example because of sanctions exposure on a payment, I would say that too and set out what we are doing to resolve it and by when.

For the technical picture I would give the shape rather than the detail: how they got in, roughly how long they were present, what they reached and what they did not. No actor names, no ATT&CK IDs, no tool names unless a board member asks. Not because boards cannot follow it, but because ten minutes spent on the technical narrative is ten minutes not spent on the decision.

I would make sure I cover the questions they will ask anyway, because being ahead of them signals control: could this happen again and what has changed, what did it cost including response and downtime, do we have a disclosure or notification obligation and what is legal's view, and how does this compare with what is happening to peers in our sector — that last one is genuinely useful context and is where intelligence adds something the incident report cannot.

On what went wrong, I would be straight about it. Boards handle bad news far better than they handle discovering later that they were managed. Neither minimising nor catastrophising — the failure, what it cost, what is being done.

I would close with what is still open, who owns each item, and when I will come back. And I would leave a one-page written version behind, because half of them will want to reread it and none of them will remember the verbal detail.