The financial and reputational risks associated with cybersecurity have elevated its priority for corporate boards, or so one would think after an outbreak of massive data breaches over the past year.

While cybersecurity should rank high on boards’ “to do” lists, board members appear to lack both the expertise and experience to be effective. In fact, a new study finds that board members could be hindering their company’s security posture given their inherent lack of knowledge about data security risks to fulfill their governance responsibilities.