Cybersecurity
Proofpoint report says cyber risk moved into workflows
A Proofpoint-authored article on the 2026 Voice of the CISO report said AI, human risk and board scrutiny were moving into everyday workflows, while the data also showed lower attack expectations and continued pressure on CISOs.
- The article was written by Patrick Joyce, Proofpoint’s Global Resident CISO, and discussed the company’s 2026 Voice of the CISO report.
- It said the report drew on responses from 1,600 global CISOs and compared findings across 2022 to 2026.
- The piece said fewer CISOs expected a material cyberattack in the next 12 months and fewer reported material loss of sensitive information than in 2025.
- It said 78% of CISOs saw GenAI as a security risk in 2026, up from 60% in 2025 and 54% in 2024, and 78% said their organisations restricted employee use of GenAI tools.
- It said 85% of CISOs reported board alignment in 2026, while 77% said excessive expectations were placed on the CISO or CSO.
Joyce said the 2026 Voice of the CISO findings pointed to a five-year pattern rather than a simple year-on-year change. He said the latest results included lower expectations of a material attack and lower reporting of material data loss than in 2025.
The article said concern about generative AI rose from 54% in 2024 to 60% in 2025 and 78% in 2026. It also said 78% of CISOs blocked or limited employee use of GenAI tools, and 79% said they were expected to manage AI-related risk without a matching rise in resources or expertise.
Joyce said human risk or error remained a leading vulnerability, at 79% in 2026. He said that among organisations with material data loss, 93% reported that departing employees had played a part, and he listed insiders, misconfigured AI tools, external attacks and third-party compromise among the causes.
He said board alignment rose to 85% in 2026 after falling to 64% in 2025, but 77% said expectations on the CISO or CSO were excessive. The article ended by arguing that AI governance, human risk and board reporting should be tied to business consequences and to the places where work is done.
Named in this story
People
- Patrick Joyce
- wrote the piece as Global Resident CISO
Companies
- Proofpoint
- published the report and supplied the article’s contributor
Products and systems
- Voice of the CISO report
- the annual research report summarised in the article
How the source tells it
It read like vendor-authored thought leadership, using Proofpoint’s own report data to argue for urgency around AI, workflow security and human-risk governance.
- vendor boosterism a contributor note and report download prompt framed the piece around Proofpoint’s own research
- urgency repeated imperative language and ‘no longer’ framing pushed the reader towards immediate action
- novelty the argument cast AI and workflow security as a new centre of gravity for cyber risk