CISOs must “take stock of their security programs and ensure that what’s being communicated to the public is rooted in reality rather than spin or wishful thinking,” said Jake Williams, a former U.S. National Security Agency hacker.