Australian CISOs report higher attack expectations and an AI resource gap

Nearly four in five Australian CISOs surveyed for Proofpoint’s 2026 Voice of the CISO report said they were expected to manage AI risk without proportional resources or expertise. The same respondents reported a more pessimistic view of attack likelihood and preparedness than the global sample, placing governance pressure at the centre of the findings.

Proofpoint released the global report and its Australian results on 9 September. The survey presents the security leader’s remit as extending beyond protecting systems and data to enabling the safe use of AI assistants, copilots and automation across large organisations.

Proofpoint says Censuswide conducted the research in May 2026 among CISOs at organisations with at least 1,000 employees. The design allocated 100 respondents to each of 16 markets, including Australia, the United States, the United Kingdom, Singapore, India and countries in Europe, the Middle East and Latin America.

Those boundaries limit how far the findings can be applied. The results reflect the perceptions and reported experiences of security leaders at large organisations, not smaller businesses or every CISO in a participating country. They do not independently measure staffing, budgets, control effectiveness or real-world attack prevalence. Proofpoint also has a commercial interest in AI, data-security and insider-risk products.

Proofpoint’s published materials put the global share expected to manage AI risk without proportional resources or expertise at either 78% or 79%. That discrepancy prevents a reliable comparison using a more precise figure, although both results amount to about four in five global respondents.

Australian respondents report a more pessimistic outlook

Proofpoint says 78% of the Australian CISOs surveyed expected their organisation to experience a material cyberattack during the following 12 months. The corresponding result across the global sample was 61%.

Australian respondents were also more likely to question their organisation’s readiness. According to Proofpoint, 68% considered their organisation unprepared for a targeted attack, compared with 56% of respondents globally.

These results measure expectations and perceived preparedness, not attack activity. Proofpoint reported that the global share expecting a material cyberattack fell from 76% in its 2025 survey to 61% in 2026. That change does not establish that the prevalence of attacks declined between the two surveys.

The Australian results also point to an expanded AI mandate. Proofpoint says 89% of Australian respondents considered safe AI use a priority, while 79% reported responsibility for AI risk without what they regarded as proportional resources or expertise. Globally, 85% viewed enabling safe use of AI assistants, copilots and automation as a two-year priority.

Concern about the technology was also higher in Australia. Proofpoint reported that 85% of Australian respondents viewed generative AI as a security risk, compared with 78% globally. The global result was 18 percentage points higher than the 60% recorded in Proofpoint’s 2025 survey, but it does not establish that AI adoption caused more incidents or material data loss.

Restrictions do not settle concerns about employee behaviour

The global results show a tension between reported controls and expectations about employee conduct. Proofpoint says 78% of respondents blocked or restricted employee use of generative AI, yet 76% believed employees were likely to use AI in ways that exposed sensitive data.

The figures do not show whether the restrictions were effective. They instead capture the concern that persisted among surveyed CISOs while their organisations sought to use AI. Proofpoint also reported that 79% identified human risk as their organisation’s largest cyber vulnerability.

Proofpoint’s findings identify insiders and departing employees among factors reported in connection with material data loss. The available information does not provide sufficient denominator detail to convert those responses into rates covering all organisations, employees or data-loss events.

Among Australian respondents at organisations reporting material data loss, Proofpoint says 49% cited direct financial loss, 46% regulatory sanctions, 43% recovery costs and 37% reputational damage. These are self-reported consequences within a survey subset, not independently audited loss figures.

The percentages should not be read as rates across all Australian organisations. The aggregate findings also provide no incident-level evidence of unauthorised access or exfiltration, so they do not support characterising the reported material data loss as a set of confirmed breaches.

Board alignment coexists with excessive expectations

Proofpoint reported that 85% of global respondents felt aligned with their boards on cybersecurity. At the same time, 77% said excessive expectations were placed on the CISO or CSO, suggesting that agreement about priorities did not remove perceived pressure from the role.

The pressure was more pronounced among the Australian respondents. Proofpoint says 83% believed excessive expectations were placed on security leaders, compared with 77% across the global sample.

Board alignment and adequate capacity are separate questions. Directors and CISOs may agree that cybersecurity and safe AI adoption are priorities while security leaders still consider the available resources or expertise insufficient. The survey does not quantify budgets, staffing changes or the capabilities respondents believed were missing.

Nor does the research identify a particular cyber incident, vulnerable AI product, exploit, threat actor, outage or service disruption. It provides a snapshot of how CISOs at large organisations described their responsibilities and preparedness in May 2026, rather than an audit of organisational security performance.

For Australia, that snapshot combines higher expectations of attack, more reported unreadiness and stronger perceptions of excessive demands with a broad requirement to make AI usable and safe. The report leaves the central governance question unresolved: whether organisations will match that expanded mandate with the resources and expertise their security leaders say are lacking.

An expanding AI governance mandate brings resource and expertise decisions into the same conversation as technical security. Put the underlying concepts into practice with The Hack Academy’s online cybersecurity training programme, which offers self-paced learning and practical exercises alongside theory in listed subjects including cybersecurity fundamentals and networking.