PII or not, companies are still going to be hacked. PII isn't even amongst the most valuable types of data that attackers are after, nor is it the most damaging

PII or not, companies are still going to be hacked. PII isn't even amongst the most valuable types of data that attackers are after, nor is it the most damaging type of data for a company to lose. It should be hard to fill CISO roles because companies should have high standards and should be looking for the best of the best to fill those roles. But that's not what I'm talking about. There is a decent sized pool of qualified security practitioners that could be CISOs, but none of them want to be because the current way things work is that they will inevitably get fired and shamed for something that they had little control over. That's not good for them, and it's not good for us, because you know what's worse than a company having a lot of insecure PII? A company that has a lot of insecure PII that also doesn't have a CISO.