Five Years of CISO Data Show Cyber Risk Moving Into Everyday Workflows
Summary
Proofpoint’s five-year CISO findings show rising concern about AI and human risk, persistent data loss, and greater board alignment alongside growing expectations—shifting security priorities toward protecting data and access within everyday workflows.
Key points
- The 2026 findings show fewer CISOs expecting a material cyberattack or reporting material sensitive-information loss than in 2025, though reported data loss remains widespread.
- CISOs identifying GenAI as a security risk rose from 54% in 2024 to 78% in 2026; 78% say their organizations restrict employee use of GenAI tools.
- 79% say they are expected to manage AI-related risks without a proportional increase in resources or expertise.
- Human risk or error was identified as the biggest cyber vulnerability by 79% of CISOs in 2026; among organizations reporting material data loss, 93% say departing employees played a role.
- Board alignment with CISOs rebounded to 85% in 2026, while 77% of CISOs said excessive expectations were placed on them.
- The article recommends treating AI governance as a data-security issue, managing human risk across the employee lifecycle, and measuring controls within everyday workflows.
Article Details
- Publisher
- Proofpoint
- Report Period
- 2022-2026
- Scope
- Global CISO views on cyber risk, AI, human risk, board alignment, and resilience
- Sample Size
- 1,600 global CISOs
- Key Statistics
- CISOs identifying GenAI as a security risk: 54% in 2024, 60% in 2025, and 78% in 2026.
- CISOs reporting that their organization blocks or restricts employee use of GenAI tools: 59% in 2025 and 78% in 2026.
- CISOs identifying human risk or error as the biggest cyber vulnerability: 56% in 2022, 60% in 2023, 74% in 2024, 66% in 2025, and 79% in 2026.
- Among organizations that experienced material data loss, 93% said departing employees played a role.
- CISOs reporting excessive expectations placed on the CISO or CSO: 49% in 2022, 66% in 2025, and 77% in 2026.
- Recommendations
- Treat AI governance as a data-security and decision-control issue, not only as an acceptable-use policy.
- Manage human risk across the employee lifecycle, especially during role changes, privilege expansion, contractor access, and employee departures.
- Frame board reporting around business consequences such as valuation, downtime, customer trust, regulatory impact, and resilience.
- Measure control effectiveness where work happens, rather than only where traditional security tools have historically been deployed.