What I have learned
Security leaders must be able to state bad news without punishment; CEOs must be able to ask what a recommendation costs and what failure looks like. Both owe the other clarity.
What I would do
I would agree on escalation triggers, a common risk vocabulary and a direct route for urgent concerns. I would ask the CISO for options with consequences rather than a single absolute answer.