However, according to the annual Voice of the CISO report from cybersecurity and compliance company Proofpoint, just 40% feel their organisation is unprepared to cope with a targeted cyber attack, compared to 56% in 2023 and 77% in 2022.

The report explores key challenges, expectations and priorities of chief information security officers (CISOs) worldwide, and according to Proofpoint, the 2024 Voice of the CISO report reveals a “growing optimism towards AI-powered solutions, however the threat of ransomware remains with more than half of CISOs admitting they would pay a ransom”.

Proofpoint also notes that the 2024 report draws attention to a notable trend - while fears of cyber-attacks continue to rise, CISOs demonstrate increasing confidence in their ability to defend against these threats, reflecting a significant shift in the cybersecurity landscape in the last year.

“In 2024, 61% of Australian CISOs surveyed feel at risk of experiencing a material cyber attack in the next 12 months, compared to 53% in 2023. However, just 40% feel their organisation is unprepared to cope with a targeted cyber attack, compared to 56% in 2023 and 77% in 2022,” explains Proofpoint.

“This may be due to the growing optimism in the role of AI-powered solutions to mitigate human-centric risks. As 51% of Australian CISOs surveyed believe that generative AI poses a security risk to their organisation, a vast majority are turning to the technology to help fight back.

“The research reveals 86% of Australian CISOs are turning to AI-powered technology to protect against human error and block advanced human-centric cyber threats reflecting a strategic pivot towards technology-driven defences.

“Human error continues to be perceived as the Achilles' heel of cybersecurity, with more than two-thirds (69%) of Australian CISOs identifying it as the most significant vulnerability. In a year of growing insider threats and people-driven data loss, more CISOs than ever (78%) see human risk, in particular negligent employees as a key cybersecurity concern over the next two years.”

“While the cybersecurity landscape continues to evolve with increasing human-centric threats, the 2024 Voice of the CISO report highlights what appears to be a pivotal shift towards greater resilience, preparedness and confidence among global CISOs,” said Patrick Joyce, global resident CISO at Proofpoint. “This year’s findings underscore a collective move towards strategic defences, including enhanced education, technological adoption, and an adaptive approach to emerging threats like generative AI.”

However, despite an increased confidence in security capabilities, 54% of Australian CISOs believe their organisation would still pay to restore systems and prevent data release if attacked by ransomware in the next 12 months - and the vast majority of CISOs (80%) said they would rely on cyber insurance claims to recover potential losses incurred, compared to 53% in 2023.”

Jennifer Cheng, Director of Product Marketing at Proofpoint for Asia Pacific commented, “Mandatory ransomware reporting was introduced by the Australian government as part of their new cyber security strategy last year in a bid to combat attacks. Ransomware costs up to $3 billion in damages to the Australian economy every year and while it’s encouraging to see a general improvement in preparedness from organisations, the devastating impacts of these attacks should not be understated.”

Key Australian findings from Proofpoint’s 2024 Voice of the CISO report include:

• Human error still tops cyber vulnerability threats but CISOs turn to AI solutions to help. This year, we are seeing an uptick in the number of Australian CISOs who view human error as their organisation’s biggest cyber vulnerability—69% in this year’s survey vs. 51% in 2023. However, 82% of CISOs believe that employees understand their role in protecting the organisation. This confidence is higher than in previous years—53% in 2023 and 75% in 2022. This may be attributed to the 86% of Australian CISOs surveyed looking to deploy AI-powered capabilities to help protect against human error and advanced human-centred cyber threats.
• Employee turnover is still a concern, yet CISOs trust their defences. In 2024, 39% of Australian security leaders reported having to deal with a material loss of sensitive data in the past 12 months, and of those, 77% agreed that employees leaving the organisation contributed to the loss. Despite those losses, 89% of Australian CISOs believe they have adequate controls to protect their data.
• The majority of CISOs have adopted DLP technology and invested more in security education. 61% of Australian CISOs surveyed in 2024 have data loss prevention technology (DLP) in place compared to just 40% in 2023. Half (50%) of CISOs surveyed invested in educating employees on data security best practices which is higher in 2024 compared to 2023 (45%).
• BEC and cloud account compromise top CISOs concerns. The biggest cybersecurity threats perceived by Australian CISOs in 2024 are business email compromise (BEC), 46%, cloud account compromise (Microsoft 365, G Suite or other) (44%) with ransomware attacks and malware tied at 39%. These top threats are different from last year in which CISOs perceived cloud account compromise (Microsoft 365, G Suite or other), ransomware attacks and distributed denial of service (DDoS) attack as the biggest threats.Generative AI tops CISOs security concerns. In 2024, 51% of Australian CISOs surveyed believe that generative AI poses a security risk to their organisation. The top three systems CISOs view as introducing risk to their organisations are: ChatGPT/other genAI (40%), Slack/Teams/Zoom/other collaboration tools (39%) and Microsoft 365 (34%).
• The Board-CISO relationship has improved significantly. In 2024, 86% of Australian CISOs agree their board members see eye-to-eye with them on cybersecurity issues. This is a significant jump from 57% in 2023, and 58% in 2022.
• CISOs pressures are unrelenting. In 2024, 62% of Australian CISOs admitted to burnout compared to 50% last year, while 73% feel they face excessive expectations, a steady increase from 58% last year and 63% the year before. The sustainability of the ongoing expectations on Australian CISOs continues to be tested—66% are concerned about personal liability (54% in 2023) and 75% (56% in 2023) would not join an organisation that does not offer Directors & Officers (D&O) insurance coverage. In addition, 63% of CISOs agreed that the current economic downturn has hampered their ability to make business-critical investments, with 47% of them being asked to cut staff or delay backfills as well as reduce security budgets.

“As we navigate through the complexities of today’s cyber threat environment, it’s encouraging to see CISOs gaining confidence in their strategies and tools,” commented Ryan Kalember, chief strategy officer at Proofpoint. “However, the ongoing challenges of employee turnover, pressure on resources, and the need for continuous board engagement remind us that vigilance and adaptation are key to our collective cyber resilience.”

The 2024 Voice of the CISO report examines global third-party survey responses from 1,600 CISOs from organisations of 1,000 employees or more across different industries. Throughout the course of Q1 2024, 100 CISOs were interviewed in each market across 16 countries: the U.S., Canada, the UK, France, Germany, Italy, Spain, Sweden, the Netherlands, UAE, KSA, Australia, Japan, Singapore, South Korea, and Brazil.

Proofpoint notes that the report offers a vital perspective on the state of cybersecurity from those at the forefront of protecting people and defending data - and “also stresses the importance of maintaining robust cybersecurity measures in the face of economic pressures and the critical role of human factors in organisational cyber readiness”.

“The survey also measures the changes in alignment between security leaders and their boards of directors, exploring how their relationship impacts security priorities,” concludes Proofpoint.

To download the 2024 Voice of the CISO report, visit: https://www.proofpoint.com/au/resources/white-papers/voice-of-the-ciso-report