CISO direct report to CEO can be bad politics. CISO direct report to CTO can be a conflict of interests for the CTO. C-suite positions need a golden parachute

CISO direct report to CEO can be bad politics. CISO direct report to CTO can be a conflict of interests for the CTO. C-suite positions need a golden parachute because they can be career-ending. You don't climb to the C-suite then go back to being an IC or lower-level director. CISO can be even riskier than other C-suite positions. So CISOs really need golden parachutes. But CISOs almost certainly don't get golden parachutes worth the while -- they are generally seen as less important than CTO, CFO, COO, and CEO.