Boats sit lower than storms give them credit for. Here's what actually helps.
A boat on open water is often the tallest thing around for a fair distance, which is exactly the wrong thing to be when a storm rolls through. There's also no basement to retreat to and usually a much longer trip back to anywhere solid than people expect once a storm is already visible. None of that means panic, it means the decision to head in needs to happen earlier than it feels like it should.
Count the seconds between a lightning flash and the thunder that follows it. If that gap is 30 seconds or less, the storm is close enough to be a real threat, and it's time to be heading toward shelter, not deciding whether to. Once you're in, the second half of the rule applies: wait 30 minutes after the last thunder you hear before treating it as over. Storms that seem to have passed regularly circle back.
Storm cells move faster than they appear to from a distance, and over open water there's nothing to slow one down the way buildings or terrain would onshore. A cell that looks like it's tracking well clear of your position can close that gap faster than expected, which is part of why waiting for a visible storm to look close before heading in is usually too late.
Get as low as reasonably possible without endangering the boat's stability, stay away from anything metal you don't need to be touching, and if there's a cabin, get inside it rather than staying out in open cockpit. Drop anchor if conditions call for it rather than trying to outrun a storm that's already overhead, a boat under way in a lightning storm is not meaningfully safer than one holding position. If anyone shows signs of a strike, burns, confusion, cardiac arrest, start CPR immediately and call for help, being struck is survivable when help starts fast.
The hardest part of all of this is usually just knowing a cell is building before it's close enough to see or hear. That's the specific gap the live lightning layer in Weather Bolt (formerly HarborCast) is built to close, showing satellite-detected strikes on a map as they happen, with proximity alerts that can fire before a storm is close enough to hear thunder from at all.