CISOs Say Risk Has Moved Into the Workflow: AI, People, and Offboarding Top the List
❓What:
Proofpoint released its 2026 Voice of the CISO report, surveying 1,600 CISOs worldwide and comparing five years of results.
78% of CISOs now call GenAI a security risk, up from 54% in 2024.
78% say their organization blocks or restricts employee GenAI use, up from 59% in 2025.
79% name human risk as their biggest cyber vulnerability.
Among organizations that had material data loss, 93% said departing employees played a role.
79% say they're expected to manage AI risk without matching resources or expertise.
Fewer CISOs expect a material attack in the next year than in 2025, and fewer reported material data loss. More than half still reported some.
⚠️Impact:
Blocking AI tools isn't the same as governing them. AI is now built into everyday productivity and SaaS platforms, so a simple allow/block approach misses most of the exposure.
Offboarding and role changes are a major data loss window, not just an HR task.
Boards are paying more attention, but they want business impact (downtime, revenue, customer trust, regulatory exposure) rather than threat counts.
Security teams are being asked to cover more ground without more people.
💡Recommendations:
Inventory which AI tools are in use, including features built into platforms you already pay for, and what data they can reach.
Write an AI use policy that covers which data goes where, not just which tools are approved.
Tighten offboarding: revoke access same day, review file sharing and downloads in the final weeks, and recover devices.
Review access when people change roles. Permissions tend to pile up.
Report security to leadership in business terms: what's at risk, what it would cost, and what's being done about it.
Read the full story HERE