Proofpoint’s 2026 CISO Survey Finds Rising AI Risk Concerns Despite Declining Reported Data Loss

Oct 20, 2026 · Original Report (PDF) ↗

Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.

Summary

Proofpoint’s survey of 1,600 CISOs across 16 markets finds rising concern about AI and human risk. Reported material data loss fell to 53%, but affected organizations more frequently reported financial losses and regulatory sanctions.

Key points

Censuswide surveyed 1,600 CISOs at organizations with at least 1,000 employees across 16 markets on May 11–18, 2026.
78% identified GenAI as a security risk, up from 60% in 2025; 79% said AI-risk responsibilities lacked proportional increases in resources or expertise.
53% reported material data loss in the preceding year, down from 66%; 56% still considered their organizations unprepared for a targeted cyberattack.
Among organizations reporting material data loss, 40% reported regulatory sanctions and 38% financial loss, up from 34% and 27%, respectively.
79% identified human risk as their biggest cyber vulnerability. Among organizations with material data loss, 46% cited malicious insiders and 93% said departing employees played a role.
Cloud account takeover was the most-selected threat at 33%; collaboration platforms led workplace-technology risk concerns at 34%.
85% reported board alignment on cybersecurity, up from 64%, while 77% said expectations placed on CISOs were excessive, up from 66%.

Article Details

Publisher: Proofpoint
Report Period: 2026-05-11 to 2026-05-18
Scope: Global CISO survey across 16 markets, covering organizations with at least 1,000 employees.
Sample Size: 1,600 CISOs; 100 respondents per market.
Key Statistics: 78% of surveyed CISOs consider GenAI a security risk in 2026, compared with 60% in 2025.
79% say they are expected to manage AI-related risks without a proportional increase in resources or expertise.
53% report material loss of sensitive information in the preceding 12 months, compared with 66% in 2025.
Among respondents whose organizations experienced material data loss, 93% say departing employees played a role.
Among organizations reporting material data loss, financial loss was cited by 38% in 2026, compared with 27% in 2025.
Recommendations: Move beyond simple AI allow-or-block policies to granular controls, monitoring, and policy enforcement.
Protect sensitive data across the employee lifecycle, including access provisioning, monitoring, offboarding, and post-departure controls.
Apply context-aware controls that account for data sensitivity, identity, permissions, behavior, and data movement across workplace systems.
Provide CISOs with authority, specialist expertise, and resources proportionate to expanding AI-governance responsibilities.
Translate technical cyber risk into business implications that boards can use to make decisions.

People

Ben McLaughlinChief Information Security Officer, Proofpoint; discusses pressure on security controls and the need for context-aware governance.Brian CoxVice President & Chief Information Security Officer, Cox Enterprises; discusses the business consequences of data loss and board-level data governance.Judy MolenaarVice President, Information Security and Chief Information Security Officer, Surescripts, LLC.; comments on granular AI controls, visibility, and governance resources.Param VigChief Information Security Officer, Solventum; advocates human-centric data protection across the employee lifecycle.Patrick JoyceGlobal Resident CISO, Proofpoint; introduces the report and discusses board alignment, CISO authority, and business-risk communication.Phil RossChief Information Security Officer, Air New Zealand; comments on preparedness and resilience across workplace technologies.

Industries