What Boards Need to Know About Tech Risk

Why do so many boards underestimate technology risk until it becomes a crisis?