The modern workplace no longer fits neatly within a network, an office or even a single application. An employee can receive a document over email, discuss it on a collaboration platform, store it in the cloud and now use an AI assistant to analyse it, all within the same workflow. For employees, this feels seamless. For security teams, however, every step creates another point at which information can move, change hands or be exposed. A recent breach at a leading bank offered a stark reminder of how quickly a single compromised employee account can become a wider security risk, with more than 700 GB of data reportedly exposed and later appearing on the dark web, even as core banking systems remained secure. The traditional cybersecurity perimeter is becoming increasingly difficult to define because risk no longer sits within one system. It moves across the connections between people, platforms and applications.
For organisations in India, this shift is happening alongside the rapid adoption of AI and cloud technologies, which makes visibility across these interactions increasingly important. For security leaders, the question is no longer simply whether individual systems are protected, but whether they can see and secure what happens between them.
According to Proofpoint's 2026 Voice of the CISO report, 93% of Indian CISOs say human risk is the biggest cybersecurity vulnerability facing their organisation. As technology changes how work gets done, people remain at the centre of how risk moves through an organisation. AI also gives us an opportunity to look at this challenge from a fresh perspective.
That shift in where risk sits changes the nature of the attack surface itself. For years, cybersecurity strategies focused on defined control points such as email, endpoints, applications, identities and data repositories. These controls remain essential, but modern work increasingly happens across them. A customer file can move from an employee's inbox to a collaboration platform, into a SaaS application and then through an AI tool. Each action may be legitimate, yet the information has crossed multiple environments with different permissions and controls.
{{/usCountry}}That shift in where risk sits changes the nature of the attack surface itself. For years, cybersecurity strategies focused on defined control points such as email, endpoints, applications, identities and data repositories. These controls remain essential, but modern work increasingly happens across them. A customer file can move from an employee's inbox to a collaboration platform, into a SaaS application and then through an AI tool. Each action may be legitimate, yet the information has crossed multiple environments with different permissions and controls.
{{/usCountry}}The risk, therefore, may not come from a single application at all. It can emerge from the way these systems, people and workflows connect. Security teams need to understand who is accessing sensitive information, where it is moving and how employees and applications are interacting with it. The human element becomes particularly important here. Among Indian organisations that experienced material data loss, 47% identified malicious or criminal insiders as a leading factor, 41% cited careless insiders and 38% identified compromised insiders. As workplaces become more connected, understanding human behaviour becomes increasingly important to understanding security risk.
As organisations become more connected, AI is becoming part of the same workflows, adding another layer to how information is accessed, processed and shared. Generative AI, copilots and automation are becoming part of everyday workflows, helping employees analyse information, create content and complete routine tasks. But as these tools become part of how work gets done, they also create new pathways through which sensitive information can be accessed and shared.
Indian CISOs recognise this tension. Some 92% view GenAI as a security risk, while 92% say enabling the safe use of AI assistants, copilots and automation is a priority over the next two years. Employee behaviour adds another dimension: 79% believe employees are likely to use AI in ways that could expose sensitive data, while 88% are concerned about customer data loss through public GenAI tools.
This creates a difficult balance. Organisations need to enable the productivity and innovation that AI can bring while ensuring that its use does not create new avenues for sensitive information to leave the organisation. In response, 91% of Indian organisations say they block or restrict employee GenAI use. Yet as AI becomes embedded in everyday work, restriction alone will become harder to sustain. The focus needs to shift towards enabling employees to use AI safely, with appropriate safeguards built into the workflow.
This is where the conversation around AI ultimately comes back to data. An AI system does not create risk in isolation. Its potential impact depends on what information it can access, who can access it and what it is permitted to do with that information.
If an employee takes sensitive data from one application, processes it through an AI tool and uses the output elsewhere, securing the AI application alone does not address the full risk. Security teams need visibility into the identity involved, the data being accessed, the application being used and the context surrounding the activity.
As organisations in India adapt to evolving data protection requirements, including the Digital Personal Data Protection (DPDP) Act, knowing where sensitive information resides is no longer enough. Organisations also need to understand who is accessing it, where it is moving and how it is being used. The challenge is shifting from protecting data wherever it sits to protecting data wherever it goes.
Managing these interconnected risks ultimately places new demands on the CISO. Security leaders are being asked to protect sensitive information, manage AI risks and support innovation. Yet 92% of Indian CISOs expect to manage AI-related risks over the next two years without a proportional increase in resources or expertise.
As work becomes more connected, CISOs need greater context around how people, data and applications interact, particularly as AI adds a new dimension. This gives security leaders an opportunity to play a more strategic role, helping the business adopt AI with the right guardrails while enabling innovation without losing sight of risk.
The connected and agentic workplace has changed the nature of cybersecurity. Risk is no longer confined to a device, application or network. It moves through the interactions between people, data and technology, with AI accelerating that movement.
Security now needs to evolve with it, following the workflow rather than simply protecting individual points within it. As organisations continue to connect people, data and technology in new ways, the ability to understand those connections will be central to enabling people to work securely in an increasingly connected world.
(The views expressed are personal)
This article is authored by Bikramdeep Singh, vice president, India & SAARC, Proofpoint.