Inability to communicate and measure cyber risk exposure easily:

Risks are spread across systems and often measured in vague terms such as high/medium/low that make prioritizing risk mitigation and investments challenging.
Additionally, boards and senior leaders want to understand risk exposure in simple, financial terms.