The main thing the CISO wants is to be able to ask and answer questions that yield deeper insights than just simply looking at vulnerability stats, auto-generated board slides, or other “vanilla” output. https://www.philvenables.com/post/a-cisos-ideal-management-tool