You have ten minutes on the board agenda. Right after the quarterly finance update and right before a discussion about the new parking garage. The room is tired. Half the members are checking their phones.
How do you get them to care about cameras and door readers?
Not with technical charts. Board members have seen a hundred slides full of red and yellow warnings. They've learned to nod and move on. What gets their attention is a simple story with honest numbers behind it.
Every board member understands one kind of story: money walking out the door. MGM is that story. In September 2023, MGM Resorts shut down computer systems across its properties after a cyberattack. For ten days, guests couldn't get into their hotel rooms. Some couldn't pay by card or pull cash from an ATM. Reservations broke. MGM later said the attack would cost it approximately $100 million in lost earnings. The cleanup itself, the lawyers and the consultants, came to less than $10 million in additional one-time expenses.9
Look at those two numbers side by side. The repairs were the small part. The big cost was all the business that simply couldn't happen while the systems were down. A hospital works the same way. Every hour of downtime means procedures that don't happen, beds that don't turn over, and patients sent somewhere else.
Put the numbers in context
If your board wants one number, give them this one. IBM's 2025 study put the average cost of a data breach in the United States at $10.22 million, the highest it has ever been. Healthcare has been the most expensive industry in that study for fourteen years in a row, and hospital breaches take an average of 279 days to find and contain.10
Numbers like that belong in the boardroom, right next to the finance update.
Start with the story. Tell them about the camera. Tell them how a device nobody was watching gave an attacker a path toward patient systems, and how long it took to stop. Make it real. Then show them where your own hospital stands.
Separate measured value from estimates
For the numbers, I suggest splitting the value into three levels, and being very clear about which is which.
Level one is what you measured. These are the hard facts from your own network. How many devices you found that nobody knew about. How many still had factory passwords. How many could reach clinical systems. How many attack paths you closed, with proof that they stayed closed. Nobody can argue with these, because they came from your hospital, not a sales brochure.
Level two is the time you saved. How many hours did your team used to spend chasing down devices, building inventories by hand, or investigating alerts? How many hours does it take now? Multiply by what your own staff actually cost. This is still measured, just in a different way.
Level three is the risk you reduced. This one is an estimate, so say so out loud. Show the assumptions you used and let the board question them. You might estimate what a day of diversion or downtime would cost your hospital, and how much more likely that day was before you closed these gaps. Being honest about this number makes the first two levels even more believable.
End with a clear request
The same evidence also does double duty. The facts that convince your board are the same facts your auditors and compliance team want to see. You build it once and use it everywhere.
End your ten minutes with one clear ask. Not a vague request for "more security." Something specific, like approval to assess every site by the end of the quarter, or to bring building devices under the same monitoring as everything else. Boards like to say yes to clear, sensible requests backed by real evidence.
Questions for your team
Could you tell the story of your biggest device risk in two minutes? Which of your numbers are measured and which are estimates? What is the one specific thing you want your board to approve?