Cybersecurity governance professor warns that executives lack the capability to assess cyber threats in implementation approaches.