Proofpoint Voice of the CISO Report 2025

Keypoints

• Annual cybersecurity reports typically begin with an introduction outlining industry context and survey methodology, followed by chapters addressing threat landscape, specific attack vectors, data security challenges, human factors, emerging technologies like AI, and evolving CISO roles, concluding with strategic recommendations.
• The 2025 report, surveying 1,600 global CISOs, emphasizes rising concerns with 76% expecting a material cyberattack within 12 months and two-thirds reporting recent sensitive data loss, noting regional variations in risk perception and readiness.
• Major cybersecurity threats identified include email fraud (37%), insider threats (37%), ransomware (36%), cloud account takeover (34%), malware (33%), and supply chain attacks (33%), indicating no single dominant vector but a diverse threat environment.
• Despite high confidence in organizational cybersecurity culture (67% agreement), a majority of CISOs feel unprepared for attacks, underscoring a gap between perceived culture strength and actual resilience.
• Data sprawl and governance emerged as top priorities, with 67% of CISOs focusing on information protection amid challenges posed by generative AI applications increasing data exposure risks.
• Ninety-eight percent of organizations have data loss prevention (DLP) programs, mostly technology-based, but only 6% have dedicated DLP resources, suggesting potential resource limitations impact effectiveness.
• Data loss consequences commonly include regulatory sanctions, recovery costs, reputational damage, and credential theft, illustrating significant post-attack impacts.
• People-related causes dominate data loss events: malicious insiders (34%), careless insiders (33%), and compromised insiders (32%), with employee departures playing a role in 92% of incidents, indicating behavioral and governance challenges.
• Two-thirds of CISOs report willingness to pay ransom following ransomware attacks, with geographical differences, revealing varied organizational stances on incident response and recovery strategies.
• Recurring themes highlight the evolving role of CISOs in balancing AI integration with risk mitigation, managing diversified cyber threats, enhancing data governance, and strengthening organizational resilience against increasingly complex attacks.