Proofpoint 2026 Voice of the CISO report finds cyber resilience improving but AI expands CISO mandate

Proofpoint has released its 2026 Voice of the CISO report, based on a survey of more than 1,600 CISOs across 16 countries. The findings show signs of greater cyber resilience, with the share of CISOs expecting a material cyberattack in the next 12 months falling to 61% from 76% in 2025, and reported material data loss declining from 66% to 53%.

However, the report also finds that risk is increasingly concentrated in people, data, applications and AI systems. Human risk is now seen as the biggest vulnerability by 79% of CISOs, up from 66% a year earlier, and concerns about generative AI security jumped 18 points to 78%. At the same time, 79% of CISOs say they are expected to manage AI-related risks without a proportional increase in resources or expertise.

The report highlights that CISOs are taking on a dual responsibility to secure and enable AI, with 85% saying safe use of AI assistants, copilots and automation is a top priority. It also notes that while data loss declined, the consequences became more severe, with regulatory sanctions, financial losses and reputational damage all rising among affected organisations. Boards are listening more, with 85% of CISOs reporting alignment, but 77% say excessive expectations are placed on them.