Without cybersecurity expertise in the C-suite and on the board, companies don’t know what they don’t know.