Boards face an increasingly urgent question: how should they engage with cybersecurity risk when it represents the single largest threat to most organizations.