Tim Brown didn’t call for indemnification laws, but suggested that CISOs dealing with legal implications for cyberattacks is stressful and a distraction from their core work.

It’s made real strides, but there’s a lot more that it could be doing, he said, and more that needs to be done.