Proofpoint’s 2024 Voice of the CISO Report Reveals that Almost Two-Thirds of UK CISOs Identify Human Error as Leading Cybersecurity Risk
LONDON, U.K. May 21, 2024 – Proofpoint, Inc., a leading cybersecurity and compliance company today released its annual
The 2024 report draws attention to a notable trend: while fears of cyber attacks continue, CISOs demonstrate increasing confidence in their ability to defend against these threats, reflecting a significant shift in the cybersecurity landscape. Almost three-quarters (73%) of surveyed CISOs in the UK feel at risk of a material cyber attack over the next 12 months, compared to 84% the year before, and 60% in 2022. UK CISOs today clearly remain on high alert, but confidence among them is growing: just 36% feel unprepared to cope with a targeted cyber attack, showing a marked decrease over last year’s 76% and 65% in 2022.
Human error continues to be perceived as the Achilles' heel of cybersecurity, with almost two-thirds (65%) of UK CISOs identifying it as the most significant vulnerability. In a year of growing insider threats and people-driven data loss, more CISOs than ever (65%) see human risk, in particular negligent employees as a key cybersecurity concern over the next two years. However, there's growing optimism in the role of AI-powered solutions to mitigate human-centric risks, reflecting a strategic pivot towards technology-driven defences.
The report examines global third-party survey responses from 1,600 CISOs from organisations of 1,000 employees or more across different industries. Throughout the course of Q1 2024, 100 CISOs were interviewed in each market across 16 countries: the U.S., Canada, the UK, France, Germany, Italy, Spain, Sweden, the Netherlands, UAE, KSA, Australia, Japan, Singapore, South Korea, and Brazil.
The report offers a vital perspective on the state of cybersecurity from those at the forefront of protecting people and defending data. The report also stresses the importance of maintaining robust cybersecurity measures in the face of economic pressures and the critical role of human factors in organisational cyber readiness. The survey also measures the changes in alignment between security leaders and their boards of directors, exploring how their relationship impacts security priorities.
“While the cybersecurity landscape continues to evolve with increasing human-centric threats, the 2024 Voice of the CISO report highlights what appears to be a pivotal shift towards greater resilience, preparedness and confidence among global CISOs,” said Patrick Joyce, global resident CISO at Proofpoint. “This year’s findings underscore a collective move towards strategic defences, including enhanced education, technological adoption, and an adaptive approach to emerging threats like generative AI.”
The 2024 Voice of the CISO report presents an overview of trends observed among the global CISO community, while also taking into account regional differences.
Key findings from the UK include:
- Human error continues to top cyber vulnerability threats but UK CISOs turn to AI solutions to help. This year, we are still seeing a large number of CISOs in the UK who view human error as their organisation’s biggest cyber vulnerability—65% in this year’s survey. However, 84% of UK CISOs believe that employees understand their role in protecting the organisation. This confidence is higher than in previous years—75% in 2023 and 68% in 2022. This may be attributed to the 87% of UK CISOs surveyed looking to deploy AI-powered capabilities to help protect against human error and advanced human-centered cyber threats.
- UK CISOs continue to fear cyber attacks but fewer feel unprepared, showing growing confidence in their security measures. In 2024, 73% of CISOs surveyed in the UK feel at risk of experiencing a material cyber attack in the next 12 months, compared to 84% in 2023 and 60% in 2022. However, just 36% feel their organisation is unprepared to cope with a targeted cyber attack, compared to 76% in 2023 and 65% in 2022.
- Generative AI tops UK CISOs’ security concerns. In 2024, 44% of UK CISOs surveyed believe that generative AI poses a security risk to their organisation. The top three systems CISOs view as introducing risk to their organisations are: ChatGPT/other genAI (40%), Perimeter network device (33%) and Slack/Teams/Zoom/other collaboration tools (31%).
- Employee turnover is still a concern, yet UK CISOs trust their defences. In 2024, 39% of UK security leaders reported having to deal with a material loss of sensitive data in the past 12 months, and of those, 69% agreed that employees leaving the organisation contributed to the loss. Despite those losses, 91% of CISOs in the UK believe they have adequate controls to protect their data.
- The majority of CISOs in the UK have adopted DLP technology and invested more in security education. 55% of UK CISOs surveyed in 2024 have data loss prevention technology (DLP) in place compared to just 34% in 2023. Less than half (47%) of CISOs surveyed invested in educating employees on data security best practices which is higher in 2024 compared to 2023 (44%).
- Ransomware and cloud account compromise top CISOs concerns in the UK. The biggest cybersecurity threats perceived by CISOs in the UK in 2024 are ransomware attacks (51%), cloud account compromise (Microsoft 365, G Suite or other) (42%) and business email compromise (35%). These top threats are different from last year in which CISOs perceived email fraud, cloud account compromise, insider threat (negligent, accidental or criminal) and smishing/vishing as the biggest threats.
- Steady stance on ransom payments with increased reliance on cyber insurance in the UK. In 2024, 60% (75% in 2023) of CISOs believe their organisation would pay to restore systems and prevent data release if attacked by ransomware in the next 12 months. 80% of UK CISOs said they would rely on cyber insurance claims to recover potential losses incurred, compared to 79% in 2023.
- The Board-CISO relationship has improved significantly in the UK. In 2024, 84% of UK CISOs agree their board members see eye-to-eye with them on cybersecurity issues. This is a significant jump from 74% in 2023, and 65% in 2022.
- UK CISOs’ pressures are unrelenting. In 2024, 54% of CISOs in the UK admitted to burnout compared to 74% last year, while 62% feel they face excessive expectations, a decrease from 74% last year and 60% in 2022. The sustainability of the ongoing expectations on CISOs continues to be tested— 61% are concerned about personal liability (79% in 2023) and 67% (78% in 2023) would not join an organisation that does not offer Directors & Officers (D&O) insurance coverage. In addition, 49% of UK CISOs agreed that the current economic downturn has hampered their ability to make business-critical investments, with 43% of them being asked to cut staff or delay backfills as well as reduce security budgets.
“As we navigate through the complexities of today’s cyber threat environment, it’s encouraging to see CISOs gaining confidence in their strategies and tools,” commented Ryan Kalember, chief strategy officer at Proofpoint. “However, the ongoing challenges of employee turnover, pressure on resources, and the need for continuous board engagement remind us that vigilance and adaptation are key to our collective cyber resilience.”
To download the 2024 Voice of the CISO report, please visit: https://www.proofpoint.com/uk/resources/white-papers/voice-of-the-ciso-report
###
About Proofpoint, Inc.
Proofpoint, Inc. is a leading cybersecurity and compliance company that protects organisations’ greatest assets and biggest risks: their people. With an integrated suite of cloud-based solutions, Proofpoint helps companies around the world stop targeted threats, safeguard their data, and make their users more resilient against cyber attacks. Leading organisations of all sizes, including 85 percent of the Fortune 100, rely on Proofpoint for people-centric security and compliance solutions that mitigate their most critical risks across email, the cloud, social media, and the web. More information is available at www.proofpoint.com/uk.
Connect with Proofpoint: X | LinkedIn | Facebook | YouTube
Proofpoint is a registered trademark or tradename of Proofpoint, Inc. in the U.S. and/or other countries. All other trademarks contained herein are the property of their respective owners.
