CISOs are confident, but material cyber risk is still rising

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Proofpoint's research: Confidence and concern are colliding, with most leaders expecting attack and many already reporting material data loss.

Why it matters: It shows why identity, data, and governance teams cannot treat awareness alone as resilience when control ownership and resourcing are still weak.

Context

The core governance problem is not whether organisations recognise cyber risk. It is whether security operating models can keep pace with data sprawl, human error, cloud account abuse, and GenAI-driven leakage without clear ownership of controls and response.

In practical terms, the article describes a mature-sounding security posture that still leaves gaps in data protection, insider risk management, board alignment, and AI governance. That intersection matters to IAM and NHI programmes because access scope, authentication trust, and data exposure are converging in the same operating environment.

Key questions

Q: What breaks when DLP exists but no one owns it properly?

A: DLP becomes inconsistent, noisy, and easy to bypass when no team owns tuning, exception handling, and response. Organisations may still report deployment coverage, but they miss the operational work that makes the control effective. The result is predictable: sensitive data moves through approved channels without being blocked or investigated in time.

Q: Why do human risk and data loss keep rising at the same time?

A: Because behaviour is only part of the problem. Over-shared workspaces, unmanaged collaboration channels, and permissive sharing defaults create leakage paths that awareness training alone cannot close. Security teams need to govern where data can move, who can share it, and which systems are allowed to process it.

Q: How do organisations know whether insider threat controls are actually working?

A: They should look for reduced standing privilege, faster revocation after role change, better session traceability, and fewer unexplained data movement events. If alerts keep firing but entitlements remain broad and offboarding is slow, the control environment is not improving. The signal is not noise volume, but narrower blast radius and quicker containment.

Q: Should boards focus more on attack probability or business impact?

A: They need both, but impact is the more useful governance lens. Probability is hard to settle in a volatile environment, while business impact forces clarity on data exposure, operational disruption, and recovery responsibilities. Board oversight should therefore ask whether identity, data, and response controls are reducing the consequences of compromise.

Technical breakdown

Why data loss persists despite broad DLP adoption

Data loss prevention is often deployed as a program label rather than an operating model. If only a small dedicated team owns classification, policy tuning, exception handling, and response, the control exists in name but not in day-to-day governance. In environments where data moves across clouds, endpoints, collaboration tools, and GenAI services, DLP must be continuously aligned to changing data flows. Otherwise, detection becomes noisy, policy coverage lags business use, and sensitive content keeps escaping through approved channels rather than obvious exfiltration paths.

Practical implication: Treat DLP as an owned governance function, not a product checkbox, and tie its scope to current data movement patterns.

How human risk becomes an access and leakage problem

Human risk is not just about careless behaviour. It also reflects the way access models, collaboration permissions, and content-sharing defaults create repeatable leakage paths. When insiders can move data into unmanaged tools, over-shared workspaces, or external GenAI services, the issue is a control boundary problem as much as a user-awareness problem. That is why human risk management intersects with IAM, DLP, and NHI governance: credentials, sharing permissions, and automation channels all determine where data can flow and who can reuse it.

Practical implication: Map the highest-risk human data paths and align access, sharing, and monitoring controls to those flows.

Why cloud account takeover changes the governance baseline

Cloud account takeover matters because a stolen identity often inherits legitimate access, which makes abuse look like normal administration or routine service activity. In cloud-first environments, the difference between an alert and a breach may be whether authentication, privilege scope, and session controls are tightly bounded. That brings IAM and NHI governance into the centre of the problem: workload credentials, service accounts, and human admin access all become high-value paths to data exposure when privilege is too broad or too persistent.

Practical implication: Constrain high-risk identities with stronger authentication, tighter privilege scope, and better session visibility.

Threat narrative

Attacker objective: The attacker’s objective is to obtain or weaponise sensitive information for theft, coercion, or operational disruption.

1. Entry begins through email fraud, insider misuse, cloud account takeover, or supply chain compromise, all of which the survey identifies as major threat paths.
2. Credentialed access or trusted channels are then used to reach sensitive data in clouds, collaboration tools, or GenAI services, often without triggering obvious suspicion.
3. Impact follows as sensitive information is exposed, removed, or held for ransom, with organisations reporting material data loss and a high likelihood of ransom payment to restore systems or prevent disclosure.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Control ownership is the real gap, not control availability. The survey shows near-universal DLP adoption alongside very limited dedicated resourcing, which is a classic governance failure. Tools that are deployed without clear ownership, tuning, and escalation paths do not reduce risk at the pace modern data movement demands. Practitioners should treat control ownership as a first-order security variable.

Human risk is becoming a data governance problem. The article does not describe a training deficit alone; it describes a system in which people, collaboration platforms, and sharing defaults move data faster than policy can contain it. That makes insider risk management, collaboration governance, and access control part of the same control plane. Organisations need to govern the paths data can take, not just the users who touch it.

Cloud account takeover and GenAI leakage are converging on the same trust model. The threats listed by Proofpoint are diverse on the surface, but they all rely on trusted identities moving data. That means IAM, PAM, NHI lifecycle control, and data protection can no longer be treated as separate workstreams. The practitioners who connect identity scope to data movement will reduce exposure faster than those who optimise each control in isolation.

Board reassurance is not the same as operational resilience. The report shows declining board alignment even as valuation impact becomes the board’s top concern after attack. That tells us executives are recognising consequence, but not yet fully absorbing control ownership or recovery readiness. Security teams should use that gap to reframe reporting around actual governance coverage, not confidence scores.

Data leakage through approved channels is the new normal risk pattern. Cloud account takeover, insider misuse, and public GenAI use all bypass perimeter thinking and depend on ordinary business workflows. This is why the next governance frontier is not just preventing exfiltration, but controlling authorised movement. Practitioners should design for sanctioned-data leakage, not only malicious theft.

From our research library:

• Generative AI use specifically increased from 33% in 2023 to 79% in 2025, according to McKinsey’s Global Surveys on the State of AI.

What this signals

Control ownership is now the differentiator. The organisations most likely to close the gap in this survey will be the ones that treat DLP, insider risk, and collaboration governance as an operating model rather than a tool stack. For identity teams, that means mapping which identities can move data, where, and under what policy.

GenAI expands the governance surface without removing the old one. Public tools do not replace insider risk, cloud account abuse, or weak sharing controls. They add another place where sensitive data can leave sanctioned workflows, so practitioners should align identity, data, and AI policy before adoption widens further.

For practitioners

• Clarify DLP ownership and operating cadence Assign a named owner for policy tuning, classification quality, exception handling, and escalation so the DLP program is actively governed rather than passively deployed.
• Map the highest-risk data movement paths Identify where sensitive data moves through email, collaboration tools, cloud storage, and public GenAI services, then align controls to those specific flows.
• Tighten governance for cloud and privileged identities Reduce the blast radius of cloud account takeover by limiting privilege scope, reviewing standing access, and monitoring anomalous use of admin and service identities.
• Rebuild board reporting around control coverage Report on DLP ownership, insider risk coverage, and identity control scope in operational terms so board oversight reflects real security posture rather than broad confidence.
• Separate GenAI enablement from unmanaged sharing Define which data types may be used in approved GenAI workflows and block uncontrolled copying into public tools, chat platforms, and unsanctioned assistants.

Key takeaways

• The survey points to a governance problem in which security leaders feel informed but still lack the resourcing and ownership needed to reduce real-world exposure.
• Material data loss, insider-driven leakage, and cloud account takeover remain central risks because sensitive information is now distributed across clouds, collaboration tools, and GenAI services.
• Practitioners should focus on control ownership, access scope, and data movement paths, not just on awareness or the existence of a control program.

Key terms

• Data Loss Prevention: Data loss prevention is the set of controls used to detect, block, and report sensitive data moving in ways the organisation does not allow. In practice, DLP must account for endpoints, email, cloud apps, APIs, and user behaviour, or it will miss the paths where real exposure happens.
• Insider Risk Management: Insider Risk Management is the practice of detecting, investigating, and reducing harm caused by legitimate identities misusing access. It covers human error, malicious insiders, compromised accounts, and increasingly AI-driven actors that can move sensitive data without breaking perimeter controls.
• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Generative AI Data Leakage: Generative AI data leakage is the unintended exposure of sensitive information through prompts, outputs, logs, embeddings, or connected tools. It occurs when models memorize, reveal, or transmit confidential data, including personal records, credentials, source code, or business content, during training, inference, retrieval, or agentic workflows.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management in practical terms. It helps practitioners connect identity control to the data and access risks that shape modern security programmes.