The Sixth Voice of the CISO Data Shows Cyber Risk Has Moved Inside the Workflow — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Proofpoint's 2026 Voice of the CISO report, surveying 1,600 global CISOs, found 78% now view generative AI as a security risk—up from 54% in 2024 and 60% in 2025—while 78% of organizations block or restrict employee GenAI use, up from 59% in 2025.
- AI governance has outpaced capacity, with 79% of CISOs expected to manage AI-related risks without a proportional increase in resources or expertise, a gap the report frames as operational rather than awareness-based.
- Human risk remains the most persistent vulnerability, cited by 79% of CISOs in 2026 (versus 56% in 2022), and 93% of organizations that suffered material data loss say departing employees played a role in the incident.
- Board alignment has been volatile, swinging from 51% in 2022 to 62% in 2023, 84% in 2024, 64% in 2025, and rebounding to 85% in 2026—while 77% of CISOs say excessive expectations are placed on the role, up from 49% in 2022.
- Reported material data loss fell year-over-year in 2026, but more than half of CISOs still report material loss and overall preparedness metrics barely moved.
- The report's central thesis, authored by Proofpoint Global Resident CISO Patrick Joyce, is that cyber risk has shifted from the perimeter to inside the flow of work—across identity, collaboration platforms, SaaS, cloud, APIs, and AI systems—requiring security to govern data where work actually happens.
Why it matters: CISOs are being asked to govern AI, human behavior, and sensitive data across increasingly embedded digital workflows without matching resources—78% see GenAI as a risk, 79% must manage it without added budget, and 77% say expectations exceed what the role can deliver. Security strategies built around perimeter defense are now structurally misaligned with where data actually moves.
Ask SkimNews
