Security leaders find themselves in a bind between corporate directives and regulatory accountability, with personal liability and board security commitment on the line.