Boards still think cyber is an IT problem.