In our technology-dependent and interconnected world, the ability to govern and oversee cyber risk is essential for driving sustainable business practices. The increasing costs of and investments in cyber risk management raise questions about the capacity of organizations to strategically control these risks. Using a simulation gaming approach, we identify five critical areas of decision-making failures that often contribute to harmful cyber events and provide recommendations for executives to rethink their approach to cyber risk management.