Proofpoint Report: CISOs Face Growing AI Security Duties Without More Resources
Summary
Proofpoint’s 2026 CISO report finds that many security leaders lack added resources for AI governance. Cloud account takeover is a leading concern, while human risk and departing employees remain prominent factors in data loss.
Key points
- 79% of CISOs say they are expected to manage AI risks without a proportional increase in resources or expertise; 78% consider GenAI a security risk.
- Cloud account takeover or compromise now tops security leaders’ threat priorities, while collaboration platforms lead workplace technology concerns.
- Human risk is identified as the biggest cyber vulnerability by 79% of respondents.
- Among organizations reporting material sensitive-data loss, 93% said departing employees played a role; malicious or criminal insiders were the most commonly identified root cause.
- Although fewer organizations report material data loss, the report says regulatory, financial, recovery, and reputational consequences have increased.
Article Details
- Publisher
- Help Net Security; report by Proofpoint
- Report Period
- 2026
- Scope
- CISO views on AI security, cyber threats, human risk, and data loss
- Sample Size
- Not disclosed
- Key Statistics
- 78% of CISOs consider GenAI a security risk.
- 79% say they are expected to manage AI-related risks without a proportional increase in resources or expertise.
- 61% of security leaders believe their organization could face a targeted attack in the next 12 months, down from 76% in 2025.
- Human risk is considered the biggest cyber vulnerability by 79% of respondents.
- Among organizations that experienced material data loss, 93% of security leaders said departing employees played a role.
- Recommendations
- Apply AI governance policies across platforms where employees access data, use AI, and automate tasks.
- Use tighter controls on employee use of public AI platforms and prioritize safe use of assistants, copilots, and automation.
- Strengthen controls around identity, permissions, and data movement between connected work applications.
- Provide CISOs with clear authority, specialist expertise, and sustained support for managing cyber risk.
People
Countries
FranceIndia recorded the highest GenAI security concern and AI resource gap, France had the highest level of restrictions on employee GenAI use, and Singapore recorded the greatest concern about employees exposing sensitiveIndiaIndia recorded the highest GenAI security concern and AI resource gap, France had the highest level of restrictions on employee GenAI use, and Singapore recorded the greatest concern about employees exposing sensitiveSingaporeconcern and AI resource gap, France had the highest level of restrictions on employee GenAI use, and Singapore recorded the greatest concern about employees exposing sensitive data through AI.