Topic starter
14/07/2026 4:25 pm
TL;DR: Across 1,600 security leaders in 16 countries, 76% expect a material cyberattack within 12 months, 66% reported material sensitive data loss, and only 6% have dedicated DLP resources despite near-universal DLP adoption, according to Proofpoint’s 2025 Voice of the CISO survey. The gap is not awareness; it is governance, resourcing, and control ownership.
Editorial analysis by NHI Mgmt Group, based on content published by Proofpoint: “Inside the Mind of Today’s CISO: Key Insights from Proofpoint’s 2025 Voice of the CISO Report”.
Key questions
Q: What breaks when DLP exists but no one owns it properly?
A: DLP becomes inconsistent, noisy, and easy to bypass when no team owns tuning, exception handling, and response.
Q: Why do human risk and data loss keep rising at the same time?
A: Because behaviour is only part of the problem.
Q: How do organisations know whether insider threat controls are actually working?
A: They should look for reduced standing privilege, faster revocation after role change, better session traceability, and fewer unexplained data movement events.
Practitioner guidance
- Clarify DLP ownership and operating cadence Assign a named owner for policy tuning, classification quality, exception handling, and escalation so the DLP program is actively governed rather than passively deployed.
- Map the highest-risk data movement paths Identify where sensitive data moves through email, collaboration tools, cloud storage, and public GenAI services, then align controls to those specific flows.
- Tighten governance for cloud and privileged identities Reduce the blast radius of cloud account takeover by limiting privilege scope, reviewing standing access, and monitoring anomalous use of admin and service identities.
Bottom line: The survey points to a governance problem in which security leaders feel informed but still lack the resourcing and ownership needed to reduce real-world exposure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 4:33 pm
Control ownership is the real gap, not control availability. The survey shows near-universal DLP adoption alongside very limited dedicated resourcing, which is a classic governance failure. Tools that are deployed without clear ownership, tuning, and escalation paths do not reduce risk at the pace modern data movement demands. Practitioners should treat control ownership as a first-order security variable.
A few things that frame the scale:
- Generative AI use specifically increased from 33% in 2023 to 79% in 2025, according to McKinsey’s Global Surveys on the State of AI.
A question worth separating out:
Q: Should boards focus more on attack probability or business impact?
A: They need both, but impact is the more useful governance lens. Probability is hard to settle in a volatile environment, while business impact forces clarity on data exposure, operational disruption, and recovery responsibilities. Board oversight should therefore ask whether identity, data, and response controls are reducing the consequences of compromise.
👉 Read our full editorial: CISOs are confident, but material cyber risk is still rising