Inexpert Supervision: Field Evidence on Boards' Oversight of Cybersecurity.

This article examines how cybersecurity expertise among corporate board directors influences the substantive versus symbolic nature of their oversight of cybersecurity risk, an emerging and complex area where expertise is scarce. Through qualitative interviews with 20 directors (both expert and nonexpert), 11 cybersecurity executives, and 7 consultants, the study finds that while all directors generally seek to perform diligent oversight, nonexpert directors often engage in legitimate but largely symbolic practices that lack depth and independence, such as asking superficial questions and relying heavily on CISOs for guidance. In contrast, directors with cybersecurity expertise are better able to ask incisive questions, detect management’s filtering of information, and provide substantive oversight, highlighting a gap in oversight effectiveness linked to expertise. The study also explores reasons why boards do not prioritize appointing cybersecurity experts, noting practical constraints and nonexpert directors’ confidence in their general business experience as sufficient for oversight. These findings contribute to corporate governance literature by contextualizing agency and institutional theories in cybersecurity oversight and inform ongoing debates about the need for board-level cybersecurity expertise.