The ability of corporate boards to govern digital and cyber risk has not increased meaningfully.