CISOs are taking on AI governance without a matching increase in resources or expertise, adding to an already broad remit spanning data protection, identity, resilience and compliance, according to Proofpoint’s 2026 Voice of the CISO report.
The Al mandate expands faster than resources (Source: Proofpoint)
AI adds to security responsibilities
GenAI is creating new concerns around sensitive data, access and employee activity. Seventy-eight percent of CISOs consider it a security risk, with the potential loss of customer data through public AI platforms a key concern.
Companies are responding with tighter controls, including restrictions on employee use. They are also looking at AI-powered security tools to reduce human error and counter threats, while making the safe use of assistants, copilots and automation a priority.
The added responsibility is not necessarily coming with additional support. Seventy-nine percent of CISOs say they are expected to manage AI-related risks without a proportional increase in resources or expertise. The task is becoming harder as AI moves beyond standalone tools and into applications employees already use for everyday work.
Governance will need to go beyond simply allowing or blocking individual tools. Security teams will need to apply policies across the platforms where employees access data, use AI and automate tasks, while being able to respond to risks as they emerge.
India recorded the highest GenAI security concern and AI resource gap, France had the highest level of restrictions on employee GenAI use, and Singapore recorded the greatest concern about employees exposing sensitive data through AI.
Attack expectations decline as workplace risks grow
Sixty-one percent of security leaders believe their organization could face one in the next 12 months, down from 76% in 2025. Reports of material data loss have also declined, although more than half still say their organization is unprepared for a targeted attack.
The threats drawing the most attention are changing too. Cloud account takeover or compromise now tops the list, while email fraud, ransomware and malware have fallen in the rankings. That puts more focus on protecting the accounts and services employees depend on to work, communicate and access company information.
Workplace technology itself is another source of concern. Collaboration platforms rank first for technologies that could introduce security risks. SaaS applications with third-party integrations and AI built into business workflows also rank highly, followed by public GenAI tools, cloud storage and automation technologies.
Employees use these services to communicate, share files and work with company data, often moving information between connected applications. That makes identity, permissions and data movement increasingly important parts of workplace security.
Human risk remains a major data security concern
Human risk is the biggest cyber vulnerability for 79% of respondents, and the data-loss findings show why. For organizations that experienced material loss of sensitive information, malicious or criminal insiders were the most commonly identified root cause.
Careless and compromised insiders were also prominent, alongside AI misuse or misconfiguration, external attacks and third-party compromise. The findings show how data loss can involve a mix of employee behavior, compromised identities and the tools people use at work.
Departing employees are a particular concern. At organizations that experienced material data loss, 93% of security leaders said employees leaving the business played a role.
Security teams report strong visibility into the number of data repositories and GenAI tools in use. The harder part is turning that visibility into controls that account for user intent, data sensitivity, permissions and how information moves between different work environments.
Data loss carries greater business consequences
Fewer organizations are reporting material data loss, but the consequences are becoming more serious when incidents occur. Regulatory sanctions, financial losses, recovery costs and reputational damage have all increased, while credential theft and the loss of critical data remain significant concerns.
“Stronger board alignment is a positive sign, but it also raises expectations. Cybersecurity is now discussed in terms of valuation, downtime, reputation, customer trust, and operational disruption. That is the right conversation, but CISOs need more than attention from the boardroom; they need clear authority, specialist expertise, and sustained support. The goal is not simply to report cyber risk more effectively, but to turn board-level understanding into better business decisions,” said Patrick Joyce, Global Resident CISO at Proofpoint.
Data protection is becoming more closely connected with identity security and AI governance. Most security leaders say they have visibility and control over sensitive data across cloud services, collaboration tools, endpoints and AI systems, and believe their existing controls address the risks associated with AI, SaaS applications and modern work practices.