Start with the business interruption, not the tool
A manufacturing director needs to understand whether production can recover after an identity compromise. A legal practice needs to understand exposure to diverted client payments. The underlying controls may overlap, but the business consequences do not. Describe the event, affected process and credible consequence before selecting a chart.
Separate strategic risks, such as dependence on a single technology supplier, from operational risks, such as overdue remediation on an exposed service. An operational finding may contribute to a strategic risk; adding both scores together would count the same exposure twice.
Make risk appetite usable
An appetite statement needs an operational consequence. If the board will not accept a prolonged loss of client access, agree a recovery objective, test the recovery path and escalate a missed objective. A vague statement about having a low appetite for cyber risk does not tell IT what to do next.
Show the residual risk after current controls, the strength of supporting evidence and the person authorised to accept it. A risk score without a named owner and review date becomes a decoration. An exception to patching needs an expiry and an explanation of what limits exposure in the meantime.
A small set of measures with the right context
Use measures that directors can interrogate: overdue high-priority exposure on critical services, recovery tests against agreed objectives, privileged access coverage and actions delayed beyond their approved dates. Explain what each denominator includes. Improving a percentage by removing unassessed systems is not an improvement in security.
Report changes in scope, failed collection and confidence alongside the trend. A green control based on an old policy document is weaker evidence than a recent test. Keep detailed asset and vulnerability information available for the operational team without crowding the board view.
Horizon supports the review; directors still make the decision
Horizon helps organisations manage risk, governance and compliance without enterprise-level complexity. Risk records, controls, evidence, owners and review dates provide the organising layer for executive reporting. A chart is useful only when someone can trace it back to that evidence.
We start from your existing register and reporting cadence rather than inventing a second governance process. Agree who updates the records, who challenges them and when the board reviews significant exceptions. Horizon does not determine risk appetite, validate every technical control or make risk acceptance decisions on your behalf.