What do CISOs need to rest easy about future AI risks?