Human error still perceived as the Achilles’ heel of cybersecurity

While fears of cyber attacks continue to rise, CISOs demonstrate increasing confidence in their ability to defend against these threats, reflecting a significant shift in the cybersecurity landscape, according to Proofpoint.

CISOs’ confidence is growing despite fear of cyber attacks

70% of surveyed CISOs feel at risk of a material cyber attack over the next 12 months, compared to 68% the year before, and 48% in 2022. CISOs today clearly remain on high alert, but confidence among them is growing: just 43% feel unprepared to cope with a targeted cyber attack, showing a marked decrease over last year’s 61% and 50% in 2022.

Human error continues to be perceived as the Achilles’ heel of cybersecurity, with 74% of CISOs identifying it as the most significant vulnerability. In a year of growing insider threats and people-driven data loss, more CISOs than ever (80%) see human risk, in particular negligent employees as a key cybersecurity concern over the next two years.

However, there’s growing optimism in the role of AI-powered solutions to mitigate human-centric risks, reflecting a strategic turn towards technology-driven defenses.

“While the cybersecurity landscape continues to evolve with increasing human-centric threats, the 2024 Voice of the CISO report highlights what appears to be a vital shift towards greater resilience, preparedness and confidence among global CISOs,” said Patrick Joyce, global resident CISO at Proofpoint. “This year’s findings underscore a collective move towards strategic defenses, including enhanced education, technological adoption, and an adaptive approach to emerging threats like generative AI.”

CISOs concerned about AI security threats

This year, we are seeing an uptick in the number of CISOs who view human error as their organization’s biggest cyber vulnerability—74% in this year’s survey vs. 60% in 2023. However, 86% of CISOs believe that employees understand their role in protecting the organization.

This confidence is higher than in previous years—61% in 2023 and 60% in 2022. This may be attributed to the 87% of CISOs surveyed looking to deploy AI-powered capabilities to help protect against human error and advanced human-centered cyber threats.

In 2024, 70% of CISOs surveyed feel at risk of experiencing a material cyber attack in the next 12 months, compared to 68% in 2023 and 48% in 2022. However, just 43% feel their organization is unprepared to cope with a targeted cyber attack, compared to 61% in 2023 and 50% in 2022.

54% of CISOs surveyed believe that generative AI poses a security risk to their organization. The top three systems CISOs view as introducing risk to their organizations are: ChatGPT/other GenAI (44%), Slack/Teams/Zoom/other collaboration tools (39%) and Microsoft 365 (38%).

46% of security leaders reported having to deal with a material loss of sensitive data in the past 12 months, and of those, 73% agreed that employees leaving the organization contributed to the loss. Despite those losses, 81% of CISOs believe they have adequate controls to protect their data.

51% of CISOs surveyed in 2024 have data loss prevention technology (DLP) in place compared to just 35% in 2023. 53% of CISOs surveyed invested in educating employees on data security best practices which is higher in 2024 compared to 2023 (39%).

Ransomware and malware top CISOs concerns

The biggest cybersecurity threats perceived by CISOs in 2024 are ransomware attacks (41%), malware (38%) and email fraud (36%). These top threats are different from last year; business email compromise (BEC) moved down from the first spot, ransomware moved up to first place and malware up to second place.

In 2024, there’s no change from CISOs’ view on paying a ransom. 62% of CISOs believe their organization would pay to restore systems and prevent data release if attacked by ransomware in the next 12 months. 79% of CISOs said they would rely on cyber insurance claims to recover potential losses incurred, compared to 61% in 2023.

84% of CISOs agree their board members see eye-to-eye with them on cybersecurity issues. This is a significant jump from 62% in 2023, and 51% in 2022.

In 2024, 53% of CISOs admitted to burnout compared to 60% last year, while 66% feel they face excessive expectations, a steady increase from 61% last year and 49% in 2022. The sustainability of the ongoing expectations on CISOs continues to be tested—66% are concerned about personal liability (62% in 2023) and 72% (61% in 2023) would not join an organization that does not offer Directors & Officers (D&O) insurance coverage.

In addition, 59% of CISOs agreed that the current economic downturn has hampered their ability to make business-critical investments, with 48% of them being asked to cut staff or delay backfills as well as reduce security budgets.

“As we navigate through the complexities of today’s cyber threat environment, it’s encouraging to see CISOs gaining confidence in their strategies and tools,” commented Ryan Kalember, chief strategy officer at Proofpoint. “However, the ongoing challenges of employee turnover, pressure on resources, and the need for continuous board engagement remind us that vigilance and adaptation are key to our collective cyber resilience.”

The 2024 Voice of the CISO report examines global third-party survey responses from 1,600 CISOs from organizations of 1,000 employees or more across different industries.