Recent findings from Proofpoint reveal that Chief Information Security Officers (CISOs) are under considerable pressure to ensure the security of artificial intelligence (AI) across enterprises. A significant number of CISOs express concern that they are not receiving the support necessary to manage these challenges effectively. In an annual report conducted by Proofpoint, it was indicated that approximately 85% of CISOs view the secure use of AI assistants, copilots, and automation tools as a top priority over the next two years.
This heightened concern over AI security aligns with the reality that eight out of ten CISOs feel compelled to manage AI-related security risks without a corresponding increase in resources or expertise. Patrick Joyce, the global resident CISO at Proofpoint, highlighted that while CISOs have a crucial role in facilitating AI adoption, they cannot shoulder the entire burden of risk alone. Businesses are adopting AI technologies at such an accelerated pace that traditional governance frameworks struggle to keep up with the evolving landscape of potential threats.
The global survey conducted with 1,600 CISOs, which included insights from respondents in 16 countries such as the United States, United Kingdom, India, and Japan, underscored significant shifts in overall risk perception and the evolving relationship between CISOs and C-suite executives. It was noted that while CISOs have grown more assured about their organizations’ risk posture, concerns about cyberattacks remain prevalent. About 60% of CISOs indicated anxiety over the possibility of a significant cyberattack, a decrease from the previous year, where around 75% expressed similar concerns. However, more than half continue to worry that their organizations may struggle to manage targeted attacks effectively.
Interestingly, about 85% of CISOs reported a better alignment with their corporate boards on security issues compared to the previous year, where fewer than two-thirds felt similarly aligned. Despite this positive trajectory, nearly 80% of CISOs stated they are experiencing overwhelming pressure from their boards regarding various issues, including operational disruption, data loss, and reputational risks. Joyce emphasized that the expectations placed upon CISOs are expanding; they are increasingly tasked with protecting the business while enabling AI, safeguarding data, managing regulatory risks, supporting business continuity, and explaining these complexities in commercial terms to their boards.
Among the pressing concerns for CISOs is the employee use of generative AI. A staggering 78% of CISOs now classify GenAI as a major security risk, marking an 18% increase from the previous year. While 86% of CISOs believe that their internal security measures adequately mitigate risks posed by AI, software-as-a-service platforms, and modern work patterns, there remains a dichotomy of confidence and caution. More than 75% express unease that employees are engaging with AI in ways that could jeopardize sensitive company data.
In addition to AI-related worries, broader concerns regarding employee behavior have surfaced. Around 80% of CISOs now identify human behavior as the most significant vulnerability within their organizations, an increase from 66% just a year prior. Among companies that have experienced material data losses in the past year, approximately 46% attributed these incidents to actions of malicious or criminal insiders, emphasizing the pressing need for organizations to foster a culture of security awareness among employees and implement robust training programs to mitigate risks.
As organizations continue to integrate AI technologies into their operations, the role of CISOs is becoming increasingly crucial. They are tasked not only with securing existing systems but also with adapting to fast-evolving technologies that pose novel challenges. By further enhancing their collaboration with executive teams and securing adequate resources, CISOs can better navigate the complex landscape of cybersecurity and protect their organizations from emerging threats. The call for support and better integration of security measures is vital as companies strive to leverage AI’s potential while maintaining robust security protocols.