32 01732 759725 At a time of growing threats, risks and vulnerabilities, much of them linked to AI, the role of the Chief Information Security Officer (CISO) has never had a higher profile. While CISOs are much in demand (and CISO services – see page 8), Proofpoint’s 2026 Voice of the CISO report suggests theirs is an unenviable lot. Not only do CISOs have to contend with the ever-increasing risk of a material cyberattack, made more likely by careless or unscrupulous colleagues, many feel their efforts are taken for granted by boards that are demanding more of them, without a corresponding increase in budget, resources or expertise. Patrick Joyce, Global Resident CISO at human and agent cybersecurity company Proofpoint, attributes much of the increase in the CISO workload to AI, which he says is fundamentally changing the CISO mandate. “Security leaders are being asked to do two things at once: protect the business from technology risk and help it embrace transformative technology safely and rapidly. As AI assistants, copilots, automation and public GenAI tools become embedded in everyday business processes, CISOs are relied on to enable innovation while preventing sensitive data, privileged access and critical workflows from being exposed. That dual responsibility is quickly becoming one of the defining challenges of the role,” he said. This diagnosis is borne out by Proofpoint’s 2026 Voice of the CISO report, a global study of 1,600 CISOs across 16 countries, which shows that while there has been progress in organisations’ cyber resilience, the CISO’s job has become significantly more complex, largely because of AI. Among UK respondents, the report highlights six key trends: 1. CISOs are now expected to secure and champion AI. UK GenAI security concerns jumped 13 percentage points year-over-year, with 71% of UK CISOs now viewing it as a security risk. At the same time, 80% say enabling the safe use of AI assistants, copilots and automation is a top priority over the next two years. Almost three quarters of CISOs (72%) are expected to manage AI-related risks without a proportionate increase in resources or expertise. 2. Cyber resilience improves, but the risk model is changing. The number of CISOs admitting to material data loss from cyberattacks fell from 74% in 2025 to 62% in 2026, suggesting that cyber resilience is improving. However, expectations of a material cyberattack among UK CISOs rose to 74% in 2026, from 63% in 2025, with 61% of UK CISOs saying their organisation is unprepared to cope with a targeted cyberattack. Concern is increasingly centred on technologies embedded in everyday work, including SaaS applications and third-party integrations (33%), collaboration platforms (32%), Active Directory/Identity infrastructure (32%), perimeter network devices (32%) and AI assistants, copilots and autonomous agents (30%). 3. The biggest risk is employee behaviour. More than two thirds of UK CISOs (69%) identify human risk as their organisation’s biggest cyber vulnerability, up from 60% in 2025. Among organisations that experienced material data loss, compromised insiders were the leading cause (cited by 48%), ahead of malicious or criminal insiders (44%) and careless insiders (37%). Notably, 95% of UK CISOs at organisations experiencing material data loss say departing employees played a role in their leak. 4. Data loss declines, but the consequences grow. While the proportion of UK organisations experiencing material data loss declined year-over-year, from 74% in 2025 to 62% in 2026, the business impact for those that did suffer data loss was more severe. There were big increases in the proportion of organisations admitting to regulatory sanctions (up from 30% to 35%), financial losses (up from 24% to 40%), post-attack recovery costs (up from 26% to 36%) and reputational damage (up from 36% to 45%). 5. CISOs trust their defences, but not their own employees’ AI habits. While 87% of UK CISOs believe their controls effectively mitigate risks introduced by AI, SaaS and modern work patterns, 66% believe employees are likely to use AI in ways that could expose sensitive data. Even more are concerned about customer data loss through public GenAI tools (71%) and block or restrict employee GenAI use (72%). 6. Boards are listening to CISOs more and expecting more in return. In 2026, 87% of UK CISOs say they see eye-to-eye with their boards on cybersecurity, up significantly from 57% in 2025. But greater alignment is not reducing pressure on security leaders. Boards are evaluating cyber risk through a commercial lens, with enterprise value, downtime, reputational damage, operational disruption and sensitive data loss among their top concerns. Three quarters (74%) of UK CISOs say excessive expectations are placed on them; 85% believe cybersecurity expertise should be required at board-director level, up from 63% in 2025. To download the full 2026 Voice of the CISO report, visit https://www.proofpoint.com/us/ resources/white-papers/voice-ofthe-ciso-report AI is changing the CISO mandate, says Proofpoint – and the evidence is in its 2026 Voice of the CISO report Pity the poor CISO CYBERSECURITY Patrick Joyce
RkJQdWJsaXNoZXIy NDUxNDM=