Proofpoint Voice of the CISO Report Highlights AI Governance and Cloud Risks

According to the latest Proofpoint Voice of the CISO report, chief information security officers are rapidly inheriting organizational AI governance mandates without receiving proportional budgets or dedicated headcount. While overall expectations of facing a material cyber attack dropped to 61%—down from 76% in 2025—security executives are grappling with novel operational headaches introduced by generative AI adoption, SaaS integrations, and persistent cloud account takeover risks.

The findings highlight a fundamental shift in threat dynamics: as corporate infrastructure transitions to cloud-native platforms and embedded AI workflows, traditional perimeter defenses and standalone email protection are no longer sufficient to stop modern data loss vectors.

AI Governance Outpaces Security Resources

The rapid mandate to secure enterprise generative AI applications has introduced severe resource friction. The survey indicates that 78% of CISOs view generative AI as a primary security risk, primarily due to the potential exfiltration of sensitive IP and customer data through public AI models, unvetted browser extensions, and integrated copilot features. Despite this expanded responsibility, 79% of security leaders report that they are expected to manage these GenAI security risks without a matching increase in financial resources or specialized staff.

Regional variations emphasize differing strategic postures globally:

• India registered both the highest concern over generative AI threats and the largest resource deficit required to address them.
• France led in administrative countermeasures, reporting the highest enforcement rates of explicit employee restrictions on GenAI usage.
• Singapore reported the acute concern regarding workforce-driven exposure of sensitive corporate data through public models.

Because AI capability is no longer restricted to standalone web portals and is instead directly embedded into daily office applications, effective governance requires moving beyond simple domain-blocking rules. Defense strategies must shift toward real-time telemetry capable of monitoring sensitive data movement, API calls, and automated workflow triggers across disparate SaaS platforms.

Cloud Account Takeover and Collaboration Tool Vulnerability

Threat actors have recalibrated their playbooks to target the primary layer of modern enterprise work: identity and cloud infrastructure. Cloud account takeover (ATO) has surpassed traditional email fraud, ransomware, and malware as the top threat drawing CISO concern.

This reprioritization reflects how adversaries operate today. Instead of dropping noisy ransomware payloads that trigger endpoint detection and response (EDR) agents, attackers increasingly rely on Adversary-in-the-Middle (AiTM) phishing frameworks, credential stuffing, and session hijacking to compromise primary Identity Provider (IdP) credentials. Once an attacker obtains a valid session token, the blast radius extends across the entire ecosystem:

• Collaboration platforms, identified by respondents as the highest-risk technology category, provide immediate internal trust. Attackers leverage compromised accounts on platforms like Slack or Teams to launch lateral social engineering campaigns, bypass external link scanning, and share malicious attachments.
• SaaS apps with third-party integrations allow attackers to establish persistence via rogue OAuth app consent approvals. By granting high-privilege scopes (such as Mail.Read or Files.ReadWrite.All) to malicious third-party applications, threat actors maintain access even after the primary user credential or session token is revoked.
• Automated workflows and cloud storage repositories permit rapid data staging and quiet exfiltration without alerting legacy perimeter DLP mechanisms.

Human Risk and Departing Employee Vector

Human vulnerability remains the single largest operational exposure, cited by 79% of CISOs as their primary cyber liability. Data loss telemetry shows that insider actions—spanning malicious actors, negligent employees, and compromised accounts—are the primary root cause of material data loss incidents.

Departing employees represent an exceptionally severe threat vector. In organizations that suffered a material data loss incident, 93% of security leaders reported that departing personnel played a direct role.

This attack pattern typically relies on the time gap between an employee’s decision to leave and the formal revocation of their directory access. During this window, employees frequently exfiltrate proprietary source code, customer lists, and strategic documents to personal cloud storage drives, secondary webmail accounts, or local unmonitored media. Furthermore, when security teams lack visibility into shadow AI tools or unsanctioned SaaS applications used by departing staff, exfiltration often goes undetected until audit logs are evaluated post-incident.

While CISOs report strong visibility into the sheer volume of data repositories and active GenAI tools within their environments, the key operational gap remains translating that visibility into strict execution. Control frameworks often fail to dynamically evaluate user risk scores, file sensitivity, and outbound network intent at the precise moment data moves across system boundaries.

Strategic Takeaways for Defense Strategy

Addressing the operational gaps outlined in the report requires security teams to align identity context directly with data loss prevention tools rather than relying on static network perimeters.

1. Tighten Conditional Access and OAuth Governance: Mitigate cloud account takeover by enforcing strict device-bound authentication (FIDO2/WebAuthn) to negate AiTM phishing tools. Security teams should implement automated policies that inventory and restrict enterprise OAuth application consent, revoking unverified third-party app permissions across Microsoft Entra ID and Google Workspace.
2. Implement Context-Aware Data Security for AI and SaaS: To counter GenAI data exposure, deploy Data Security Posture Management (DSPM) and inline CASB controls configured to inspect prompt payloads for Sensitive Personally Identifiable Information (SPII), source code, and API keys before traffic reaches external model endpoints.
3. Execute High-Risk HR Offboarding Playbooks: Integrate HR management platforms directly with Security Information and Event Management (SIEM) and DLP solutions to automatically trigger elevated monitoring on user accounts marked for departure, enforcing strict controls on USB transfers, personal webmail access, and large-scale cloud file downloads 30 to 60 days prior to offboarding.