The evolution of enterprise cybersecurity has long been communicated as a continuous upward trajectory of escalation: more aggressive threat actors, broader data loss, mounting operational pressure, and an ever-increasing sense of urgency. While this narrative remains immediately recognizable to industry veterans, a retrospective analysis of the past five years of "Voice of the CISO" research suggests a far more nuanced reality. The role of the Chief Information Security Officer has not simply grown more difficult because every quantitative metric happens to be rising simultaneously; rather, it has become significantly more complex because the center of gravity for corporate risk has shifted, migrating inward to align directly with the dynamic ways modern work is actually executed.
The release of the latest 2026 Voice of the CISO findings reveals encouraging signs of stabilization in certain areas. Notably, fewer CISOs anticipate a material cyberattack in the coming 12 months, and a smaller percentage report material losses of sensitive information compared to the figures recorded in 2025. However, these localized improvements exist within a broader, multi-year trend line that remains volatile and unsettled. Over a five-year observation window, attack expectations have persistently fluctuated—rising, falling, and climbing once again—while board alignment has swung dramatically, and human risk has stubbornly remained a central point of vulnerability. Simultaneously, artificial intelligence has rapidly transitioned from an emerging, peripheral concern into a core operational mandate. The resulting landscape defies simple categorization as either an era of straightforward improvement or one of systemic decline; instead, it illustrates a fundamental relocation of risk.
This distinction holds profound implications for what security leaders should be actively optimizing for. The primary question confronting CISOs is no longer confined to predicting which specific threat vector will strike next. Instead, the modern inquiry focuses on mapping where critical business work takes place, determining who or what maintains access to sensitive assets, and verifying whether the organization can adequately protect sensitive data as it flows seamlessly across individuals, cloud environments, collaboration suites, software-as-a-service applications, and AI-enabled workflows.
The Five-Year Trend Is Not Linear
While the year-over-year movement between 2025 and 2026 offers vital tactical context, it fails to capture the broader macro story. Examining a five-year horizon highlights a profession that has been continually forced to absorb and navigate consecutive waves of disruptive change, rather than following a smooth and predictable maturity curve.
The primary utility of this multi-year perspective lies in its resistance to premature conclusions. Although anticipated attacks cooled in 2026 following a high-water mark in 2025, overall expectations remain visibly elevated above 2022 baselines. Similarly, while reported data loss decreased year-over-year, more than half of surveyed CISOs still grapple with material loss, and general preparedness metrics have barely budged. Meanwhile, board alignment rebounded to reach its highest level across the entire survey series, yet excessive executive expectations rose concurrently. Taken together, these longitudinal data points depict a security function that is successfully gaining institutional visibility and leadership support, even as it is simultaneously tasked with governing an exponentially wider and more complex operating environment.
AI Turned the CISO Agenda From Protection to Governance
Artificial intelligence serves as the most striking illustration of how swiftly this operating environment has transformed. In 2024, 54 percent of responding CISOs identified generative AI as a legitimate security risk. That figure escalated to 60 percent in 2025, before surging to 78 percent in 2026. Across this same timeframe, the overarching corporate conversation surrounding AI has shifted decisively from cautious experimentation to deeply embedded daily use. Automated assistants, productivity copilots, automation frameworks, and agentic workflows are now foundational components of standard business operations.
The instinct among security teams to restrict user access is understandable, and numerous enterprises are actively enforcing such limits. Data from 2026 indicates that 78 percent of CISOs now report that their organizations block or actively restrict employee utilization of generative AI tools, a sharp increase from 59 percent in the previous year. However, simple restriction is fundamentally distinct from true governance. As AI capabilities become permanently integrated into enterprise productivity suites, collaborative platforms, SaaS ecosystems, and automated business workflows, a binary allow-or-block policy proves far too blunt for the realities of modern enterprise productivity.
The more durable challenge is determining whether organizations possess the capability to govern AI safely within operational context. Key questions include understanding precisely what data a user is permitted to access, defining what actions an AI tool is authorized to summarize, generate, or execute, and establishing protocols for what occurs when an automated assistant transitions from merely answering an informational query to directly influencing a high-stakes business decision or triggering an automated action.
This dynamic firmly merges the AI conversation with traditional data security. Enterprise risk involving AI extends far beyond prompt injection, underlying model flaws, or hallucinations; it directly encompasses sensitive information, identity management, user permissions, user intent, and operational control. This reality underscores the significance of a telling resource signal within the 2026 report: 79 percent of CISOs state they are expected to manage emerging AI-related risks without receiving a proportional increase in financial resources or specialized technical expertise. The persistent gap is no longer a lack of awareness, but a severe limitation in operational capacity.
Human Risk Is No Longer a Soft Problem
Throughout the five-year trajectory of the CISO dataset, human risk has consistently emerged as one of the most stubborn and persistent vulnerabilities. While the terminology has evolved over the years—shifting gradually from human error to human risk—the overarching statistical direction is unmistakable. The percentage of CISOs identifying human risk or error as their single greatest cyber vulnerability stood at 56 percent in 2022, 60 percent in 2023, 74 percent in 2024, 66 percent in 2025, and climbed to 79 percent in 2026.
This trend demands a fundamental reconsideration of how organizations approach and discuss the human element in security. Human risk is frequently categorized primarily as a training and awareness problem, yet the 2026 findings demonstrate that it encompasses a much broader systemic footprint. Among organizations that suffered material data loss, an overwhelming 93 percent reported that departing employees played a measurable role in the incident. Furthermore, the leading root causes of material data loss included malicious or careless insiders, compromised accounts, the misuse or misconfiguration of AI tools, external attacks, and third-party vendor compromises. In essence, data loss increasingly occurs at the complex intersection of human behavior, digital identity, granular access permissions, specialized tooling, and user intent.
Consequently, human risk must be analyzed as a comprehensive systems problem featuring a human interface. An individual user may act maliciously, carelessly, become compromised, remain over-permissioned, suffer from insufficient governance, or simply operate within an internal business process that grants them significantly more access than the enterprise can safely justify. While traditional awareness training retains a supporting function, it cannot single-handedly carry the burden of defense. Organizations must instead evaluate behavior directly within its operational context: verifying who the user is, monitoring precisely which data assets they are touching, determining whether their access level remains appropriate, assessing whether a specific action appears anomalous, and identifying whether shifts in role, employment status, or underlying intent have altered the baseline risk profile.
The Boardroom Is Closer to the Problem, But Not Necessarily Closer to Resolution
The trajectory of board relations represents one of the most revealing metrics across the multi-year study, largely due to its fluctuating nature. In 2022, 51 percent of CISOs indicated that their board of directors shared a cohesive perspective on cybersecurity priorities. That alignment rose to 62 percent in 2023 and reached 84 percent in 2024, before dipping to 64 percent in 2025 and rebounding strongly to 85 percent in 2026. This volatility highlights that while cybersecurity has secured a firmer, more permanent footing on the board agenda, true alignment remains contingent upon the CISO’s ability to successfully translate complex technical risks into tangible commercial risks, operational resilience metrics, regulatory exposure, and customer trust.
The specific issues that corporate boards reportedly care about reinforce this commercial framing. CISOs indicate that directors are primarily concerned with enterprise valuation, significant operational downtime, reputational damage, the loss of sensitive data, operational disruptions, customer attrition, and revenue reduction. This set of priorities reads less like a traditional security operations dashboard and more like a comprehensive enterprise risk agenda.
While this shift creates significant opportunities for security leaders, it simultaneously elevates executive expectations. In 2026, 77 percent of CISOs report that excessive expectations are placed upon their role, a notable increase from 66 percent in 2025 and 49 percent in 2022. Achieving better board alignment has not lightened the professional burden; rather, it has rendered the role considerably more visible, commercially integrated, and directly accountable for managing risks that now span human behavior, enterprise data, digital identity, artificial intelligence, regulatory compliance, and business continuity.
The Next Phase of Resilience Will Be Decided Inside the Flow of Work
The practical takeaway derived from five years of comprehensive CISO data is not that the global threat landscape has grown less dangerous, but rather that danger has become deeply embedded within everyday enterprise operations. Modern security strategy must adapt to reflect where work actually takes place. This requires treating digital identities, collaboration platforms, SaaS applications, cloud repositories, endpoints, application programming interfaces, automation engines, and AI systems as integral components of a unified risk fabric, rather than as fragmented, standalone control domains.
For cybersecurity leaders, several operational priorities naturally emerge from these insights. AI governance must be addressed as a fundamental data security and decision-control challenge, rather than being relegated merely to an acceptable-use policy document. Human risk requires active management across the entirety of the employee lifecycle, with particular scrutiny applied during role transitions, privilege expansions, third-party contractor onboarding, and employee departures. Furthermore, board reporting should transition away from raw threat volume metrics toward clear business consequence frameworks, assisting directors in understanding precisely how cyber exposures map directly to corporate valuation, downtime vulnerabilities, customer trust, regulatory exposure, and overarching organizational resilience. Finally, security control effectiveness must be measured directly where work happens, rather than relying exclusively on traditional security tools deployed at historical network perimeters.
Ultimately, the overarching conclusion of the research is that cybersecurity’s center of gravity has definitively shifted from the network perimeter to the daily workflow. The contemporary enterprise is no longer secured solely by intercepting attacks at the corporate edge; instead, security is achieved by comprehensively understanding how people, data, digital identities, applications, and intelligent systems interact in real time.
This encapsulates the modern CISO mandate: not merely preventing the next isolated incident, but enabling the broader enterprise to operate securely within environments where productivity and risk have become permanently intertwined.
