Inaugural study reveals businesses are racing ahead with AI despite a lack of trust in security, putting the personal data of everyday Australians at risk

• 60% of Australian organisations are not fully confident their AI security controls would detect a threat, yet 80% are pushing ahead with full-scale AI deployment.
• Only 28% of Australian organisations are fully prepared to investigate an AI-related incident when one occurs.

SYDNEY, AUSTRALIA, 28 April, 2026 – Proofpoint, Inc., a leading cybersecurity and compliance company, today released its 2026 AI and Human Risk Landscape report 2026 AI and Human Risk Landscape report, which explores the widening gap between how quickly organisations are operationalising AI and how prepared they are to secure and investigate the risks that follow. The global study, which surveyed more than 1,400 security professionals across 12 countries, examines how rapid AI adoption is transforming enterprise collaboration and exposing structural weaknesses in security controls and incident response.

AI is increasingly permeating organisations and is now operational across most functions, with deployments spanning customer support, internal messaging, email workflows, and third-party collaboration. Four in five (80%) organisations in Australia have deployed assistants beyond pilot stage, and almost three quarters (72%) are advancing autonomous agents. Yet while organisations are investing in AI tools and controls, many cannot confirm those controls are effective. 60% are not fully confident their AI security controls would detect a compromised AI, and close to half (44%) of organisations with controls in place have already experienced a confirmed or suspected AI-related incident.

Further, most organisations report they are not fully prepared to investigate AI-related incidents that span multiple systems and channels and only about one-quarter (28%) say they are fully prepared to investigate one. In this respect, Australia is falling behind its regional counterparts, as Singapore and India report 32% and 57% readiness to investigate, respectively.

“This year’s findings highlight a widening divide between AI adoption and security readiness,” said Ryan Kalember, Chief Strategy Officer at Proofpoint. “Organisations are scaling AI assistants and autonomous agents across core workflows, yet many cannot confirm their controls are effective or fully investigate incidents that move across collaboration channels. As AI becomes embedded in how work gets done, security leaders must rethink how they protect trusted interactions across people, data and AI systems.”

“In Australia, organisations need to be just as deliberate about governance, visibility and control as they are about innovation,” said Adrian Covich, Vice President, Systems Engineering, Asia Pacific and Japan at Proofpoint. “It is critical to put stronger policies around data access, improve monitoring across the channels where people and AI interact, govern AI agents with the same discipline as privileged users, and reduce the complexity that comes from fragmented security tools. That stronger security posture will be essential if organisations want to scale AI with confidence.”

Key Australian findings from Proofpoint’s 2026 AI and Human Risk Landscape report include:

• AI Deployment Has Outpaced Security Readiness. AI adoption has moved into production faster than governance frameworks have matured. While four in five (80%) organisations in Australia have deployed assistants beyond pilot stage and almost three quarters (72%) are advancing autonomous agents, more than half (53%) describe security as catching up, inconsistent or reactive. Close to two in five (39%) Australian organisations report experiencing a suspicious or confirmed AI-related incident, indicating that exposure is already present in live environments.
• Collaboration Channels Are the Primary AI Attack Surface. AI is expanding the attack surface, enabling threats to spread at machine speed and impact connected workflows. While email remains the most common threat vector at 53% in Australia, exposure now extends across SaaS and cloud applications (46%), AI assistants or agents (39%), and social and messaging platforms (37%). Among organisations that experienced an AI-related incident, exposure increases across every channel, with 67% in third-party SaaS and cloud applications, and 62% involving AI systems.
• Confidence Exceeds Control Effectiveness. While many organisations in Australia have security controls in place, they also lack assurance. More than three in five (63%) organisations in Australia report having AI security coverage in place, yet 60% are not fully confident those controls would detect compromised AI. Further, close to half (44%) of organisations with controls still reported an AI-related incident. In Australia, gaps persist in visibility into AI or agent activity (51%), training (45%), and governance alignment across teams (40%).
• Investigation Readiness Lags Behind Incident Reality. When AI-related incidents occur, many organisations in Australia struggle to investigate them effectively. Only about one-quarter (28%) of respondents say they are fully prepared to investigate an AI- or agent-related incident, and more than one-third (36%) report difficulty correlating threats across channels. As AI-related activity spans email, collaboration platforms and cloud systems, the ability to reconstruct events depends on visibility across connected environments, which many organisations do not yet have.
• Tool Sprawl is a Structural Barrier. Fragmentation across security stacks is compounding the challenge, limiting visibility and slowing response when incidents move across systems at machine speed. Almost all (97%) organisations in Australia say managing multiple security tools is at least moderately challenging, and 45% describe it as very or extremely difficult. Respondents cite operational cost pressures (45%), integration challenges (43%), and overlapping or redundant tools (39%).
• Security Architecture Becomes a Strategic Priority as AI Scales. 56% of Australian organisations are actively pursuing vendor and tool consolidation, and 54% believe a unified platform is more effective than point solutions. Over the next 12 months, more than two-thirds (68%) plan to expand AI protections, 58% intend to extend collaboration channel coverage, and 56% expect to move toward a unified platform approach.

"While AI has introduced new risks, such as prompt engineering, its bigger impact has been amplifying the risks we've always had," Kalember said. "Running untrusted code, mishandling sensitive data, and losing control of credentials are the same challenges that humans have created for decades. AI executes them at machine speed and scale. When organisations hand AI the keys to act on their behalf—across customers, partners, and internal systems—the blast radius of any one of those failures grows dramatically. The answer isn't to treat AI as a novel threat category, but to apply rigorous, proven controls to what AI touches, what it runs, and what it's allowed to authenticate as. Organisations that get that foundation right early will scale AI confidently. Those that don't are just automating their own exposure."

To download the 2026 AI and Human Risk Landscape report, please visit: https://www.proofpoint.com/us/resources/threat-reports/ai-human-risk-landscape-report

Methodology

The 2026 AI and Human Risk Landscape report provides a global view into how organisations are adopting AI and managing the security risks that follow. The research examines AI deployment maturity, control effectiveness, incident experience, collaboration channel exposure, and investigation readiness as AI assistants and autonomous agents become embedded in enterprise workflows. In January 2026, more than 1,400 full-time security professionals across organisations of varying sizes and industries were surveyed. Respondents represented 20 industries and spanned 12 countries, including the U.S., the U.K., France, Germany, Italy, Spain, the UAE, Australia, Japan, Singapore, India, and Brazil.

About Proofpoint, Inc. 

Proofpoint, Inc. is a global leader in human- and agent-centric cybersecurity, securing how people, data and AI agents connect across email, cloud and collaboration tools. Proofpoint is a trusted partner to over 80 of the Fortune 100, over 10,000 large enterprises, and millions of smaller organisations in stopping threats, preventing data loss, and building resilience across people and AI workflows. Proofpoint’s collaboration and data security platform helps organisations of all sizes protect and empower their people while embracing AI securely and confidently. Learn more at www.proofpoint.com. 

Connect with Proofpoint on LinkedIn.

Proofpoint is a registered trademark or tradename of Proofpoint, Inc. in the U.S. and/or other countries. All other trademarks contained herein are the property of their respective owners.