The enterprise cybersecurity landscape is undergoing a profound transformation, moving away from a predictable line of escalation toward a complex convergence of human behavior, artificial intelligence governance, and board-level scrutiny. According to a sweeping five-year analysis of the "Voice of the CISO" research series by cybersecurity firm Proofpoint, the daily realities of Chief Information Security Officers (CISOs) are no longer defined solely by an escalating volume of external threats. Instead, the very center of enterprise risk has shifted inward, embedding itself directly within the systems, applications, and workflows where daily business operations take place.
Authored by Patrick Joyce, Global Resident CISO at Proofpoint, the latest 2026 findings synthesize insights gathered from 1,600 global security leaders. The data reveals that while certain security metrics show year-over-year improvement—such as a slight decrease in the number of CISOs anticipating a material cyberattack in the upcoming twelve months—these positive indicators are overshadowed by a turbulent five-year trend line. Over the past half-decade, attack expectations have fluctuated wildly, board alignment has swung between optimism and tension, and human risk has remained a stubbornly persistent vulnerability.
Rather than signaling a simple story of institutional improvement or decline, the data underscores a fundamental relocation of risk. Security leaders are increasingly forced to grapple with a decentralized operating environment where critical work happens across cloud platforms, collaboration tools, Software-as-a-Service (SaaS) applications, and AI-enabled workflows. Consequently, the primary challenge facing modern security executives is no longer just anticipating the next external threat vector, but maintaining oversight of sensitive data as it flows freely across diverse people, tools, and digital platforms.
The Five-Year Trend Is Not Linear
Evaluating the cybersecurity profession solely through year-over-year metrics can obscure the broader trajectory of the industry. The five-year view of the Voice of the CISO research paints a picture of a specialized workforce that has been forced to absorb relentless waves of technological and operational disruption without the benefit of a smooth maturity curve.
This longitudinal perspective resists easy conclusions. While attack expectations cooled somewhat in 2026 following a high-water mark in 2025, they remain significantly above the baseline established in 2022. Similarly, although reported data loss fell between 2025 and 2026, more than half of all surveyed CISOs still report suffering material losses of sensitive information, while overall organizational preparedness has remained virtually stagnant.
At the same time, board alignment has rebounded to reach its highest level across the five-year survey series, yet this positive development has occurred concurrently with an escalation in excessive organizational expectations placed on security leaders. Taken together, these metrics outline a security function that enjoys greater visibility and institutional support than ever before, yet is simultaneously tasked with governing a vastly expanded and increasingly complex operating perimeter.
AI Turned the CISO Agenda from Protection to Governance
No factor has accelerated this operational complexity quite like the rapid adoption of artificial intelligence. The trajectory of GenAI concerns among enterprise security leaders has been dramatic. In 2024, roughly 54% of CISOs identified generative artificial intelligence as a primary security risk. That figure climbed to 60% in 2025 and surged to an overwhelming 78% by 2026.
Concurrently, the broader business community has transitioned from experimenting with standalone AI applications to embedding intelligent tools directly into daily operations. Assistants, automated copilots, and agentic workflows are now foundational components of productivity suites and business processes.
In response to these emerging exposures, many organizations initially turned to restrictive access models. In 2026, 78% of CISOs reported that their organizations actively block or restrict employee use of generative AI tools, a sharp increase from 59% in the previous year. However, security experts emphasize that restriction is not synonymous with governance. As AI capabilities become permanently baked into productivity software, collaboration platforms, and core business applications, binary allow-or-block policies prove far too blunt for the realities of modern work.
The more durable challenge for enterprises is establishing governance in context. Security teams must determine what data an individual user can access, what tasks an AI tool is permitted to summarize or execute, and how to manage the downstream consequences when an automated agent moves beyond answering queries to directly influencing business decisions and triggering automated actions.
Ultimately, managing AI risk has evolved into an exercise in data security and identity management. The core concerns extend far beyond model hallucinations or vulnerable prompts; they center on sensitive information, user permissions, intent, and operational control. This expansion of responsibility collides directly with a stark resource gap highlighted in the 2026 report: 79% of CISOs state they are expected to manage sophisticated AI-related risks without a proportional increase in specialized personnel, budget, or resources.
Human Risk Is No Longer a Soft Problem
Throughout the five-year span of the Voice of the CISO data, human risk has consistently ranked among the most prominent vulnerabilities cited by enterprise security leaders. Evolving from early discussions focused strictly on human error to a broader conceptualization of comprehensive human risk, the metric has remained elevated, cited by 56% of CISOs in 2022, peaking at 74% in 2024, and reaching 79% in 2026.
This persistence demands a fundamental shift in how organizations conceptualize human-centric vulnerabilities. While employee security awareness training remains a baseline necessity, the 2026 findings demonstrate that human risk cannot be mitigated through education alone. Among organizations that suffered material data loss, an overwhelming 93% reported that departing employees played a role in the incident.
The leading root causes behind these material data losses point to a complex intersection of human behavior and system architecture. Incidents were attributed to malicious or careless insiders, compromised user credentials, the misuse or misconfiguration of AI tools, external attacks, and third-party vendor compromises. Data loss is increasingly tied to the convergence of user behavior, identity management, access permissions, and underlying intent.
Consequently, modern security strategies must treat human risk as a systemic challenge featuring a human interface. Whether a user is acting maliciously, operating carelessly, falling victim to a credential compromise, or simply working within an overly permissive corporate environment, organizations must understand behavior within its operational context. Security teams need visibility into who is touching specific data, whether granted permissions are justified, and whether a change in employment status, role, or user behavior indicates an altered risk profile.
The Boardroom Is Closer to the Problem, but Not Necessarily Closer to Resolution
The relationship between security leadership and corporate boards represents one of the most volatile yet revealing trends tracked over the past five years. In 2022, only 51% of CISOs reported that their board of directors shared a unified vision regarding cybersecurity priorities. That alignment improved to 62% in 2023 and jumped to 84% in 2024, before dropping back to 64% in 2025 and rebounding to 85% in 2026.
This fluctuation highlights a maturing dialogue. While cybersecurity occupies a firmer, more permanent spot on the boardroom agenda, achieving true alignment depends heavily on the CISO’s ability to translate complex technical vulnerabilities into clear commercial risks, regulatory exposures, and operational resilience metrics.
The issues driving boardroom concerns reflect this commercial framing. According to survey respondents, directors are primarily focused on business valuation, significant operational downtime, reputational damage, the compromise of sensitive data, loss of current customers, and revenue disruption. This agenda closely mirrors broader enterprise risk management rather than traditional security operations metrics.
While this elevated focus creates new opportunities for security leadership to secure strategic support, it has also inflated expectations. In the 2026 survey, 77% of CISOs reported that excessive expectations are placed on their roles, up from 66% in 2025 and 49 in 2022. Greater board visibility has not lightened the administrative or operational load; instead, it has rendered the role more visible, highly commercial, and directly accountable for exposures spanning human behavior, regulatory compliance, data governance, and business continuity.
The Next Phase of Resilience Will Be Decided Inside the Flow of Work
The overarching takeaway from five years of cumulative CISO data is that the contemporary threat landscape has not necessarily grown less dangerous, but rather that danger has embedded itself deeply into the standard workflow of the enterprise. Securing the modern organization requires shifting from a perimeter defense model to an integrated risk fabric that encompasses identity providers, collaboration suites, cloud repositories, software APIs, endpoints, and artificial intelligence systems.
For security leaders navigating this environment, several strategic priorities emerge. AI governance must be addressed as a data security and decision-control challenge rather than an isolated acceptable-use policy. Human risk management must span the entire employee lifecycle, with heightened attention given to contractors, role transitions, privilege expansions, and employee departures. Furthermore, board reporting must consistently map technical vulnerabilities directly to business consequences such as valuation, downtime, regulatory impact, and customer trust.
Ultimately, the center of gravity for enterprise cybersecurity has decisively shifted from the network edge to the workflow. The modern enterprise is protected not merely by blocking attacks at the perimeter, but by understanding how people, data, identities, applications, and intelligent systems interact seamlessly every day.
