Proofpoint Survey Finds AI Security Controls and Incident Readiness Lag Adoption

Summary

Proofpoint’s survey of 1,453 security professionals found 42% reported suspected or confirmed AI-related incidents, while only 33% felt fully prepared to investigate them. The report highlights gaps in controls and cross-channel visibility.

Key points

The January 2026 survey covered 1,453 full-time security professionals across 20 industries and 12 markets; its emphasis on senior staff at larger enterprises may skew adoption findings.
AI assistants were beyond pilot at 87% of respondents’ organizations, while 76% were piloting or rolling out autonomous agents; only 48% said security was involved from the start.
Overall, 42% reported suspicious activity or confirmed AI-related incidents. Among organizations with AI security controls, 50% reported such activity or incidents; this does not establish whether controls detected or missed them.
Although 63% reported AI security controls, 52% were not fully confident those controls would detect compromised AI.
Among respondents reporting AI-related incidents, threat activity appeared in email at 67%, SaaS or cloud applications at 57%, and AI assistants or agents at 53%.
Only about 33% felt fully prepared to investigate AI- or agent-related incidents, and 41% reported difficulty correlating threats across channels.
The report recommends unified cross-channel visibility and AI-specific protections to address fragmented monitoring, governance, and investigation capabilities.

Article Details

Publisher: Proofpoint
Report Period: 2026 report; survey conducted in January 2026
Scope: AI deployment, security controls, incident experience, and investigation readiness across email and collaboration channels in 12 markets and 20 industries.
Sample Size: 1,453 full-time security professionals answering a 21-question survey. The sample skewed toward senior leaders at larger enterprises and may reflect more advanced adoption than the broader market.
Key Statistics: 87% of surveyed organizations reported AI assistants beyond pilot; 76% were piloting or rolling out autonomous agents.
41.7% of respondents reported suspicious activity or a confirmed incident involving AI; this measure does not distinguish confirmed incidents from suspicions.
Among organizations reporting AI security controls in place, 50% also reported a suspicious or confirmed AI-related incident; the survey does not establish whether controls detected or missed it.
52% were not fully confident their controls would detect a compromised AI.
32.6% reported being fully prepared to investigate an AI- or agent-related incident.
Recommendations: Establish unified visibility across the channels where people and AI collaborate, with the ability to investigate incidents spanning multiple channels.
Secure collaboration channels beyond email, including interactions involving AI agents, suppliers, and connected workflows.
Use controls designed for AI-specific risks within collaboration environments rather than relying solely on siloed, channel-specific protections.