Picture a plausible Tuesday morning: an agent in your environment calls a tool through an MCP server to pull a file, update a record, or kick off a workflow. Nobody in that chain checks who is asking, beyond the fact that something asked and the server answered. The scene is illustrative. The underlying gap is not. It’s the literal finding sitting inside entry MCP07 of the OWASP MCP Top 10, and it should bother you more than the last CVE alert you triaged. There’s no incident report attached to it. That’s the point.

Whoever Asks, Gets the Tool Call

Security Boulevard’s coverage, syndicating an Imperva analysis published in August 2026, lines up three OWASP lists against three layers of an AI system. The OWASP Top 10 for LLM Applications (2025) covers the conversation layer: prompt injection, sensitive information disclosure, system prompt leakage, improper output handling, and unbounded consumption make up five of its ten entries. The OWASP Top 10 for Agentic Applications (2026), released in December 2025 with ten ASI-prefixed entries running from agent goal hijack (ASI01) to rogue agents (ASI10), covers the action layer: what happens once a system stops answering and starts doing.

The third list is the one worth stopping on. The OWASP MCP Top 10, still in beta, covers what Imperva’s piece calls the connective tissue: the Model Context Protocol wiring that connects an assistant to the tools and data it acts on. MCP07 addresses insufficient authentication and authorization on tool calls. On the question of who may call a tool, the piece’s framing is blunt: the answer is whoever asks. That’s a missing identity layer for machines, and it now has a project number instead of just a bad feeling.

MCP09 Gave Shadow AI a Number, Not a Cure

Sitting two entries down the same beta list is MCP09: shadow MCP servers, frequently running on default credentials, that nobody in security ever inventoried.

Security Boulevard’s characterization is exact. The shadow AI problem now has an OWASP number.

Scale that against where machine identity actually sits today. Palo Alto Networks’ 2026 Identity Security Landscape report, based on a vendor-sponsored survey of 2,930 cybersecurity decision-makers, found that machine identities now outnumber human identities 109 to 1, up from 82 to 1 a year earlier. Of those 109, 79 are AI agents. Read that as a directional finding from one report, not settled fact. But even directionally, it means every MCP07 gap and every MCP09 shadow server sits underneath a machine-identity population that grew faster than most governance programs did.

63% Can’t Enforce Purpose Limits. That’s the Math That Changed

Here’s why this beta checklist lands differently than it would have a year ago. In the Kiteworks Data Security and Compliance Risk: 2026 Forecast Report, 100% of organizations surveyed have agentic AI on their roadmap and 51% already run agents in production. Yet 63% cannot enforce purpose limitations on those agents, and 60% cannot terminate one that starts misbehaving.

An agent you cannot purpose-bind and cannot kill is precisely the agent MCP07 describes: one that gets a tool call approved because it asked, not because anyone verified it should. And an environment where more than half of organizations already run agents in production, without a full inventory of what’s calling what, is precisely the environment MCP09 describes. The two OWASP entries aren’t describing a future risk. They’re describing the default state of AI programs that scaled adoption ahead of authorization. Call it the ask-and-you-shall-receive default: the tool call goes through because nothing in the chain was built to say no.

The Fix Is Architectural, Not Incident-Driven

Be clear about what this piece is and isn’t. There’s no breach disclosure behind MCP07 or MCP09, no regulator citation, no forensic timeline. The fit here is standards and architecture, not incident response. That distinction matters, and so does a second one: Security Boulevard’s own source article is syndicated Imperva content, and it closes on an Imperva product pitch. That doesn’t make the underlying OWASP mapping wrong. It means the argument should be evaluated against the checklist, not against either vendor’s sales page, including this one.

Patching individual MCP server configs one at a time is the tactical response, and it stops scaling the moment your organization’s MCP footprint matches a 51%-in-production adoption curve. The architectural alternative is a governed access layer that authenticates and scopes every tool call the same way, regardless of which server or which agent is asking, so there’s no server left ungoverned enough to go “shadow.” The Kiteworks Secure MCP Server is one example built on that premise: every file, folder, or record operation an agent requests is evaluated in real time against role-based and attribute-based access policy, credentials never surface inside the model’s context, and the resulting audit trail lands in the same log a human’s activity does.

That last point is the one to hold onto. This isn’t a case of extending governance to agents that were previously left alone while humans stayed supervised. An agent connecting through the MCP server inherits the access of the human or service account that authorized it, evaluated under the same policy engine, not a separate one carved out for machines. Kiteworks’ own framing for this is that regulators regulate data, not the model or agent framework moving it. HIPAA, CMMC, and GDPR don’t ask whether a person or a process touched the record. They ask whether the access was authorized, logged, and defensible. MCP07 and MCP09 are the OWASP-numbered version of that same question, aimed at the one layer, tool-call authorization, most programs haven’t gotten to yet.

What to Do Now

Here’s the whole game: you don’t need an incident to justify fixing this. You need an inventory and an owner.

1. Pull the OWASP MCP Top 10 beta list and score every MCP server you run against it, starting with MCP07 and MCP09.

2. Inventory every MCP server actually running in your environment, not just the ones IT provisioned. If you can’t produce that list today, MCP09 already describes your gap.

3. Ask whoever owns your AI agent program one direct question: when an agent calls a tool, what identity gets checked, and can you produce the log that proves it. “Whoever asks” is not an acceptable answer.

4. Map all three OWASP lists, LLM, Agentic, and MCP, against your AI governance committee’s charter. If nobody owns the connective-tissue layer, name an owner this week.

5. Treat this as an audit-evidence problem, not a threat-hunting problem. The question a regulator or a board member asks isn’t whether you detected an attack. It’s whether you can prove who was authorized to call that tool, and when.

OWASP didn’t find an incident this month. It found the gap between what your agents can already do and what you can prove they were allowed to do. That gap is the whole story, and it was there long before anyone gave it a number.

In late January 2026, TechCrunch reported that Madhu Gottumukkala, the acting director of the U.S. Cybersecurity and Infrastructure Security Agency, had uploaded at least four documents marked “for official use only” to the public version of ChatGPT the previous summer. He had requested permission to use ChatGPT at an agency that blocks it for most employees over data retention concerns. Sensors caught the activity roughly a week after it started. Nobody phished a credential or exploited a CVE. The nation’s top civilian cyber-defense official simply pasted sensitive material into a chat window because it was the fastest way to finish his work.

That is not a hacking story. It is the story Akamai’s new State of the Internet: Enterprise AI Usage Risk Report 2026 is telling. The report, built on data from Akamai’s LayerX platform (Akamai acquired LayerX earlier this year), argues the defining AI risk facing your organization stopped being “who can access AI.” The real exposure now is what a well-meaning employee shares with a tool they are fully authorized to use, one prompt at a time, in pieces too small for any control you own to flag.

The Fragmentation Problem Your DLP Was Never Built to Catch

Legacy DLP assumes sensitive data moves through named channels (an email attachment, a file upload, an SFTP transfer). AI does not move data that way. It moves through prompts, conversational context, code snippets, screenshots, copied text, and generated responses, and Akamai’s data shows how granular that fragmentation gets.

The average enterprise AI conversation contains 5.09 prompts, but the median is 2. The top 5% of conversations run 18 prompts or more. Usage concentrates the same way. The average user holds 36 conversations, the bottom half of users 12 or fewer, and the top 5% at least 144. A small population of power users drives a disproportionate share of activity, shares more sensitive business context per session, and increasingly delegates execution-level work to an AI agent.

None of that trips a single alert. It shows up as hundreds of unremarkable interactions that, stitched together, reconstruct exactly what your data classification policy exists to protect. In a follow-up survey to its own Kiteworks Data Security and Compliance Risk: 2026 Forecast Report, Kiteworks found that among 459 security and compliance leaders, 73% had no purpose-binding controls restricting what data their AI agents can reach, and half could not produce a complete AI data access audit record within one business day. That is not a detection gap. It is an evidence gap, and evidence gaps are what a regulator asks about first.

Half the Traffic Runs Through Accounts Nobody Manages

Fragmentation would be manageable if you at least knew whose data was fragmenting. You mostly do not. Akamai found that 47.11% of enterprise AI conversations run through personal identities rather than corporate-managed accounts, close to a coin flip on whether a given AI interaction sits inside your identity perimeter at all. Worse, 14.4% of conversations initiated from a corporate email address run on a personal freemium subscription instead of an enterprise license, so a corporate-looking login can still feed a vendor’s public training pipeline.

The split sharpens by platform. ChatGPT runs 61.36% personal, Copilot 63.92% personal, Claude 61.09% personal. DeepSeek runs 99.83% personal, essentially unmanaged, just as U.S. officials weigh adding the company to the Commerce Department’s Entity List over concerns it supports Chinese military and intelligence objectives. Purpose-built enterprise offerings look nothing alike. Gemini Enterprise runs 98.15% corporate; Copilot for M365 runs 90.55% corporate. The identity gap isn’t inherent to AI. It’s a function of which product got deployed and enforced.

Verizon’s 2026 Data Breach Investigations Report independently corroborates the shape of the problem. It found 45% of employees are now regular AI users on corporate devices, up from 15% the prior year, and that source code, not PII, is the single most common data type leaving the enterprise for external GenAI tools. The identity gap and the fragmentation gap are the same gap, described from two angles.

Attackers Have Stopped Bothering With the Human

The report’s fifth risk category should worry a CISO most. AI agents now operate inside the enterprise with broad access granted for speed, and attackers increasingly target them directly rather than the person who deployed them.

LayerX researchers demonstrated the shift twice in the past year. In CometJacking, a single malicious link hijacked Perplexity’s Comet browser agent through indirect prompt injection, instructing it to encode Gmail and Calendar contents in Base64 and exfiltrate them to an external server. In CursorJacking, a rogue browser extension disguised as a theme or productivity add-on queried the Cursor coding assistant’s unprotected local database directly, extracting API keys and session tokens with no user interaction. LayerX scored the flaw 8.2 on CVSS.

Neither attack touched the human user’s credentials. Both targeted the agent acting on the employee’s behalf, because that agent already holds the privileged access an attacker wants (email, calendar, active sessions, connected repositories). CrowdStrike’s 2026 Global Threat Report puts a number on the wider trend, an 89% year-over-year increase in operations by AI-enabled adversaries. The lesson isn’t that agents should be walked back. It’s that an agent acting on an employee’s behalf needs the same identity governance, monitoring, and revocation rights you’d demand for the employee.

Governance Must Cover the Agent and the Human, Not Just One

The fix is neither “block AI” nor “trust the vendor’s terms of service,” and both intuitive answers fail. Blocking AI pushes power users toward the personal accounts you can’t see at all, the 47.11% problem restated. Trusting a vendor’s data handling policy does nothing about a rogue extension or a hijacked agent walking in through the front door.

Akamai’s mitigation framework instead calls for treating prompts, uploads, downloads, and copy and paste activity as inspectable content in context, rather than as files run through pattern matching, and for extending identity and audit controls to AI agents as a new class of enterprise identity, governed alongside the humans who deploy them. Kiteworks’ original 2026 Forecast Report had predicted this collision was coming. Every organization surveyed expected agentic AI on its 2026 roadmap; fewer than 40% expected containment controls ready to manage it. The follow-up survey found the gap had widened, not closed.

A handful of vendors are now building toward exactly that architecture, one policy plane governing sensitive content across email, file transfer, web forms, and AI interactions under a single evidence-quality audit trail, whether the party on the other end is a person or an agent acting on their behalf. Kiteworks’ platform, built on a hardened virtual appliance with FIPS 140-3 validated encryption, is one example of a system designed around that premise rather than around detecting AI misuse after the fact.

The Three Questions to Ask Before Your Next Board Update

Get honest answers to these before a regulator, auditor, or board member asks first.

1. Who are your AI power users, and what share of your sensitive data exposure do they account for? App-access lists won’t show you; conversation depth will.

2. Which AI logins on your network are personal or freemium accounts, regardless of what email domain signed up? Treat every one as unmanaged until proven otherwise.

3. Can prompts, uploads, downloads, and copy and paste into AI tools be inspected in real time, the way file transfers already are?

4. Do you have an inventory of every AI agent running in your environment, what it can access, and one control point to revoke that access?

5. If asked for a complete AI data access audit trail tomorrow, could your team produce it inside a business day, not a sprint?

The CISA leak didn’t require a hacker. Neither will the next one.

On May 21, 2026, OpenTelemetry graduated from the Cloud Native Computing Foundation, the observability project with the second-highest project velocity of any CNCF project, trailing only Kubernetes, per the CNCF’s own graduation announcement. That milestone is not the story.

The story is what shipped alongside it. Over the two years leading up to graduation, the project built out generative AI semantic conventions: a standard vocabulary for describing what a model, an agent, or a tool did during a session, as OpenTelemetry’s own account of the milestone describes it. For the first time, agent behavior has a shape that any compliant backend can read the same way. There is no breach in this piece. No CVE, no enforcement action, no incident of any kind. This is a story about infrastructure, and that is exactly why it matters. The infrastructure AI governance depends on is standardizing, and the gaps left inside it are no longer someone else’s implementation detail. They are the whole argument.

What OpenTelemetry Actually Records

The new conventions organize an agent run into three span types, as Kovrr’s analysis of the standard lays out. A root span records the full, multi-turn agent session. Child spans record each individual model interaction, carrying token counts and the reason generation stopped. A separate span type records tool execution, and that third type was extended during 2026 specifically to cover Model Context Protocol calls, giving agent tool use a portable representation instead of a framework-specific log line buried in someone’s vendor console.

That MCP-specific extension is the detail worth sitting with. Before it, what an agent called through MCP, and with what arguments, lived in whatever shape the framework happened to emit. The Model Context Protocol project’s own maintainers had been wrestling with exactly this gap, proposing OpenTelemetry trace support for MCP precisely because agent-side traces and MCP server-side traces were disconnected from each other. Standardizing that span type means the question of what an agent invoked now has one answer instead of a dozen vendor-specific ones. That is a genuine advance. It is also, on its own, a smaller advance than it sounds.

The Governance Deficit This Standard Drops Into

Standardized telemetry did not arrive because the industry had gotten ahead of agentic AI. It arrived because the industry is badly behind. The World Economic Forum’s Global Cybersecurity Outlook 2026 found that 87% of cyber leaders identify AI-related vulnerabilities as the fastest-growing cyber risk they face, according to the WEF’s own report. Kiteworks’ own Kiteworks Data Security and Compliance Risk: 2026 Forecast Report, published in December 2025, predicted that 100% of organizations would carry agentic AI on their roadmap in 2026, with fewer than 40% having deployed containment controls to manage it.

Read that again. Full deployment, minority containment. A standardized way to record what an agent did does not close that gap. It documents it more consistently.

Three Things the Trace Will Never Tell You

Here is where the Kovrr analysis earns its keep, because it does not oversell the standard. It names three absences, and argues each is a deliberate design boundary rather than an oversight the next release will fix.

No verdicts. A span records that a model produced an output. It does not record whether that output was hallucinated, unfaithful, toxic, or a policy violation. Evaluation is a separate discipline, deliberately kept out of the telemetry layer.

No authorization, either. A span carries a service identity and a model provider. It does not carry whether the human on whose behalf an agent acted was actually authorized to touch the specific data the agent reached, and it does not distinguish an agent operating under its own credential from one operating under a delegated one. Knowing a call occurred is not the same as knowing it should have occurred.

And no data sensitivity. Content capture exists for prompts and completions. Nothing in the convention classifies what that content was. Whether a prompt carried regulated health data, financial data, or CUI is a determination applied to the trace afterward, by something else, or by no one at all.

Stop asking whether your organization has AI observability. Here is the question that actually matters: when the trace shows an agent touched a record, can you produce, on demand, who that agent was acting for and whether that person was cleared to see it?

Where the Architecture Has to Pick Up the Slack

None of the three gaps above is a flaw in OpenTelemetry. They are a boundary the standard drew on purpose, and Kovrr’s own framing treats the boundary as correct: a convention that tried to standardize a verdict would have to standardize the policy behind it, and policy differs by organization. That means the second gap, the authorization gap, cannot be solved by waiting for the next OpenTelemetry release. It has to be solved by the architecture the agent and the human both operate inside.

This is not an incident piece, and I am not going to pretend otherwise to manufacture urgency. There was no breach behind this story. What there is instead is a precise architectural fit, and it deserves to be described precisely rather than oversold. The Kiteworks Secure MCP Server enforces per-request attribute-based access control against every AI operation, mirroring the same role-based and attribute-based rules that already govern human users, and logs each action to a tamper-evident audit trail that feeds an organization’s SIEM. That closes the authorization gap specifically: it is a record not just that an agent called a tool, but that the human identity behind the call was evaluated against policy at the moment of the call, alongside every human who touches the same system. Agents and humans sit inside one governance plane, not two. The Secure MCP Server does not hand you an output-quality verdict, and it does not manufacture a data-sensitivity label your own policy hasn’t defined. If your attribute-based access control encodes data classification, that third gap narrows too. If it does not, it stays open, and no vendor closes it for you.

What This Means Now

• Pull the trace from your highest-privilege agent workflow and check whether it names the human identity the agent acted for. If it only names a service account, you have the authorization gap in production right now.

• Ask your platform or observability vendor whether their AI spans already cover the MCP tool-execution extension. If they answer with a roadmap instead of a version number, plan around the gap for the next two quarters.

• Separately track three things your telemetry will never hand you: an output-quality verdict, an authorization decision, and a data-sensitivity label. Assign an owner to each. None of them are the same owner.

• If your agents run under a shared service credential instead of delegated, revocable ones, fix that before you fix your dashboards. A beautifully instrumented trace built on top of an unauthorized access pattern is still an unauthorized access pattern, just a well-documented one.

OpenTelemetry gave AI governance a shared way to describe what happened. It was never going to tell you whether it should have.

Consider a security engineer at a mid-size insurer who reruns the same adversarial prompt suite against a customer-service model that cleared testing five months earlier. Same prompts. Same categories. Same environment -- nobody touched the network, the contract, or the guardrail configuration. Four attempts succeed that failed in March.

That is not a breach. Nobody attacked anything. Kovrr’s August 16 analysis makes the harder point: an AI security assessment doesn’t describe a system, it describes a moment, and the moment closes the day the report gets filed. Here’s the question that actually matters for anyone who has to sign that report: what exactly are you attesting to when you say a system “passed”?

What It Actually Is

Kovrr names three mechanisms, and only one of them resembles anything in a traditional software audit.

The first is non-determinism. A prompt injection attempt blocked on the first try can succeed on the fifth, and a single test run is a sample from a distribution, not a measurement of a fixed state. The OWASP GenAI Security Project’s 2026 Top 10 for LLM Applications, released ten days before Kovrr’s piece, ranks Prompt Injection first again, and for a reason that backs this up directly: the flaw is architectural, instructions and data share one channel, and, as the project leads put it, “the model will be fooled” no matter how much a team spends trying to prevent it.

The second is provider-side drift. The vendor revises the model on its own release schedule, and a guardrail validated in March can weaken in April with no change to your prompt, your configuration, or your code.

The third is retrieval corpus drift. Add one document to a RAG store and you change what the model can say. Add a document containing hidden instructions and you change what it might do -- that’s indirect prompt injection, and it means the model was never the whole system being tested. The corpus is half the surface, and it’s the half that changes weekly.

Read that again: all three failure modes can invalidate a signed-off assessment while nothing in your environment moved. That is not a vendor talking point. It is a structural property of the technology.

The Pattern

This isn’t a niche concern confined to chatbots. It’s what happens when non-human actors multiply faster than the controls built for them.

Palo Alto Networks’ 2026 Identity Security Landscape report found organizations now manage 109 machine identities for every human identity, and AI agents already account for a growing share of that number. Companies expect agent growth of 85% over the next 12 months. Most can explain what an agent is for. Far fewer can say what it’s allowed to touch, when its access gets revoked, or which systems inherit that access by default.

CrowdStrike’s 2026 Global Threat Report supplies the attacker’s side of the same coin. AI-enabled adversaries increased operations 89% year over year in 2025, and 82% of that year’s detections were malware-free -- meaning intrusions rode valid credentials and trusted identity flows instead of exploits. When the access path itself is the weapon, whose credential is doing the acting stops being a compliance footnote.

Why the Math Got Worse

Here’s the compounding factor that makes this different from the last five years of “patch faster, test more often” advice. Organizations are deploying agents faster than they’re deploying the identity controls to tell agents apart from the humans who authorized them.

The Kiteworks Data Security and Compliance Risk: 2026 Forecast Report found 100% of surveyed organizations have agentic AI on their roadmap, but only 37% enforce purpose binding on what those agents can do. Sixty-three percent cannot enforce purpose limitations at all. Sixty percent cannot terminate a misbehaving agent. Fifty-five percent cannot isolate an AI system from the rest of the network.

Now overlay Kovrr’s own observation about attribution: “an agent operating with a human’s credentials appears in logs as that human unless machine identity is resolved separately, and agent identity is the prerequisite rather than a refinement.” Put those two data points together and you get a specific, ugly scenario. An agent inherits a service account. It takes an action nobody would authorize a human to take alone. The log says a person did it -- because, as far as the log is concerned, a person did.

The Architectural Question

None of this means the fix is a better prompt-injection filter or a more frequent penetration test. Those address non-determinism and provider drift, and Kovrr is right that they need to run on a schedule, not just before launch. They do not address attribution. A guardrail that catches a bad prompt still can’t tell you, after the fact, whether it was Priya or Priya’s expense-report agent that pulled the file.

This piece of the problem lives at the data-access layer, not the model layer -- and it’s worth being precise about scope, because it’s tempting to oversell it. Resolving machine identity doesn’t make a model’s outputs deterministic. It doesn’t stop a poisoned document from reaching a RAG pipeline. What it does is make sure that when an agent touches a file, the audit trail records the agent, not the human whose session it borrowed.

That’s the specific gap Kiteworks’ Secure MCP Server is built to close: every AI request is authenticated and authorized against attribute-based access controls independently of the human who launched the session, then logged under its own identity in a tamper-evident audit trail. Kiteworks Compliant AI applies the same principle to programmatic workflows -- RAG pipelines, data extraction jobs, agent-to-agent exchanges. Both sit inside the same Kiteworks Control Plane that governs human and agent access under one policy engine, one encryption standard, one audit log. Humans don’t lose oversight because an agent is in the loop. The agent’s actions just stop hiding inside the human’s identity.

There’s no incident behind this argument, and it would be dishonest to pretend otherwise. Nothing in Kovrr’s piece describes a breach. The fit here is architectural: the attribution gap Kovrr names is exactly the non-human-identity problem this category of tooling exists to close. It is not a claim that any specific product would have stopped anything, because nothing here happened.

What This Means Monday Morning

Pull your last three AI vendor security attestations and check whether they name a model version, a test date, and an attempt count. If they just say “passed,” you’re holding a photograph, not a monitoring feed.

Ask your AI vendors how they detect provider-side model revisions, and whether that detection triggers a re-test rather than a release note buried in a changelog.

Audit your service accounts for agent traffic. If you can’t separate “this API key is a scheduled job” from “this API key is an agent acting semi-autonomously,” you have an attribution gap before you have a monitoring gap.

Put machine identity resolution on the same roadmap line as continuous monitoring, not after it. A perfectly monitored system that still logs agents as humans gives you a detailed record of the wrong actor.

When your RAG pipeline gets a new source connected, treat it as a production change and give it the review your code changes get. It is one.

The assessment you signed off on last quarter already expired. The only question left is whether your logs will tell you who acted while you weren’t looking, or just whose name happened to be on the session.

Picture a typical Tuesday morning. Someone on your finance team pastes a client contract into a free chatbot to get a faster summary. Someone in engineering feeds a repo’s worth of source code into an AI coding assistant to debug a release. Someone in HR uploads a spreadsheet of comp data to draft a policy memo. None of them think they did anything wrong. None of them will mention it to you. And none of it shows up on a single security dashboard you own.

That is the scene playing out inside most enterprises right now, and the instinct in security leadership is still to respond with a training module. That instinct is the problem. The 2026 Cost of Insider Risks Global Report puts a number on what happens when you keep treating an architecture failure as a behavior failure: average annual insider risk cost has reached $19.5 million per organization, and shadow AI is now the leading driver of negligent insider incidents -- employees routinely moving confidential documents, source code, and strategy through AI channels nobody approved.

Nineteen and a half million dollars. Read that again. That’s not a training gap. That’s a line item finance doesn’t know it’s carrying.

Here’s the thesis: shadow AI stopped being a policy problem the moment it became a recurring, quantifiable cost. It belongs on the same reporting line as fraud losses and breach remediation -- not buried in a security awareness budget.

What It Actually Is

The 2026 Data Security and Compliance Risk Report found that 65% of organizations discovered employees using unapproved AI tools with organizational data in the past 12 months. Sixteen percent discover it monthly or more. Twenty-eight percent discover it quarterly. This is not a rare lapse. It is a standing operational condition, discovered on a schedule, the way you’d discover a recurring vendor invoice.

And the data moving through those tools is not incidental. Among organizations using employee-facing AI chatbots, 36% route customer and client data through them. 33% route IT credentials and access requests. 31% route employee personal and HR data. 30% route financial data. None of those are categories any organization intends to hand to an AI vendor. They are categories employees hand over anyway, because the tool is faster than the approved workflow -- and because nothing in the environment stops the request.

The Market Reality: Bans Are Gone, Controls Never Arrived

For a while, the default corporate response to this was prohibition. That response is evaporating. Cisco’s 2026 Data and Privacy Benchmark Study found that outright bans on AI tool usage dropped from 28% of organizations in 2025 to 7% in 2026 -- a 21-point decline in a single year. Enterprise AI usage more than doubled over the same period, with 62% of workers now using AI at work.

Here is the part that should bother a CFO more than a CISO: that 21-point drop in bans did not come with a corresponding rise in technical controls to replace them. Organizations removed the barrier. They left the gap open. That is not a governance evolution. That is a governance vacancy, and vacancies compound.

Why the Math Got Worse

Twenty-six percent of organizations experienced sensitive data exposure through an AI tool in the past 12 months, per the same report. Run that against the discovery numbers and a pattern falls out: shadow AI use is nearly universal, exposure incidents are common, and the organizations catching the most of it are the ones with the best detection -- not the worst problem. North America reports the highest frequent shadow AI discovery rate, 24% monthly or more, and the highest overall AI incident rate, 84%. The report is explicit that detection capability, not shadow AI prevalence, drives the regional spread. Regions reporting less shadow AI are not cleaner. They are blinder. A lower discovery rate is not good news. It’s a visibility gap wearing a good-news costume, and it means the true exposure in weaker-detection regions is very likely higher than what shows up in any survey.

That reframes the entire risk conversation. If detection quality is the variable, the $19.5 million figure is not a ceiling. It’s a floor for organizations with above-average visibility, and an underestimate for everyone else.

The Architectural Question

Stop asking how to get employees to behave better. Here is the question that actually matters: where in your stack is sensitive data structurally prevented from leaving through an AI channel nobody approved? Only 28% of organizations have AI-specific data loss prevention deployed -- the control that actually blocks sensitive data from reaching an unapproved AI tool at the point of transmission, rather than documenting the violation after it already happened. Only 27% have purpose binding in place, restricting what an AI system or agent is even permitted to touch. Fewer than half of organizations that discovered shadow AI went on to deploy technical controls to prevent it from recurring. The most common response instead was updated policy guidance -- a behavioral fix bolted onto an architectural hole. Thirty-six percent name workforce training as a top investment priority: the most commonly planned response to a problem that training cannot structurally solve, because the gap it’s meant to close sits in the network, not in the employee’s judgment.

Call it what it is: governance theater. Policies get rewritten. Nothing in the network actually stops the data.

This is where the fix has to be architectural rather than administrative. You cannot train your way past a missing control layer. What closes this gap is a single governing layer that applies consistent, technically enforced policy across every channel where sensitive data can leave the building -- email, file transfer, web forms, APIs, and yes, the AI chatbot someone just opened in another tab -- so “unapproved” becomes a state the system enforces, not a state the handbook describes. A hardened, single-tenant architecture with unified policy enforcement and audit-quality logging turns “we told employees not to” into “the data literally could not leave through that channel.” That governance applies the same way whether a human or an AI agent is the one making the request -- one policy layer, not a separate memo for each. That distinction is the entire difference between a $19.5 million line item and a line item that shrinks every quarter.

What to Do Monday Morning

1. Pull your last four quarters of shadow AI discovery data and price it the way finance would -- as a recurring loss category, not an incident log.

2. Ask your AI governance owner one question: what percentage of sensitive data channels have technical enforcement versus policy language only. If you don’t have an answer, you don’t have a control. You have a memo.

3. Audit whether your organization dropped a usage ban in the last 18 months without replacing it with a technical control. If so, you have a documented, dated governance gap -- useful information for your risk register and uncomfortable information for your board deck.

4. Stop budgeting training as your primary AI data security investment. Budget detection and enforcement instead, and let training support the control layer rather than substitute for it.

5. Put the dollar figure in front of the board before the auditors put it in front of you.

Training doesn’t show up on a balance sheet. A $19.5 million exposure does. Start reporting it like one.

Read the full findings in the 2026 Data Security and Compliance Risk Report.

On March 18, 2024, the SEC fined two investment advisers a combined $400,000 for lying about the AI inside their products. Delphia claimed it used machine learning to analyze client data it never actually collected. Global Predictions called itself the “first regulated AI financial advisor” and was neither regulated in that specific way nor building the AI it advertised. The SEC’s own release is almost bored in its phrasing: false and misleading statements, Section 206 violations, penalties, done.

That is not really a story about two small advisers getting caught puffing. It’s a preview.

A working paper out of Carnegie Mellon’s AI Capstone Program, run with AI-adoption analytics firm Larridin, just put a number on exactly what that gap is worth across the market. The study scored roughly 500 large U.S. public companies on how concretely they describe their AI systems in 10-K filings, then checked that score against what actually happened to their revenue. Here’s the whole game: companies that named specific, deployed AI systems with quantified results grew about 8 percentage points faster, year over year, than companies that talked about AI in the abstract. Holding sector, size, and prior growth momentum constant.

Read that again. Eight points. Not from spending more on AI. Not from hiring more AI engineers. From being specific.

The study that priced specificity

The researchers – Yixiao Li, Siru Tao, Xin Xu, and Hanzhe Hong – built three independent signal sets: Larridin’s own AI Transformation Tracker scores for 562 companies, an LLM-extraction pipeline that scored 478 companies’ 10-K filings on investment intensity, “narrative concreteness,” and risk-disclosure depth, and a hiring-intensity measure built from 30,861 classified job postings across 536 companies. Every non-null disclosure score had to cite a verbatim passage from the filing – no score without a receipt. In an audit, 87 to 90% of those citations checked out against the source text.

Narrative concreteness – deployed, named use cases with measurable outcomes, not “AI-powered” marketing copy – was the only signal that survived every control they threw at it: sector, company size, and pre-existing growth momentum. Coefficient of 0.080, p = 0.009. Everything else in the study washed out, attenuated, or never mattered in the first place.

Every other AI metric washed out

AI investment intensity looked promising until the researchers controlled for company size, at which point it stopped being significant (p = 0.14). The AI-hiring signal, built from real job-posting data, showed no relationship with performance at all – and the researchers admit their hiring snapshots were collected after the financial quarter they were tested against, so it was never a fair predictive test to begin with. Risk-disclosure depth, the closest thing to an “AI policy” signal in the study, had almost no discriminating power because 75% of the companies sampled landed at the identical score. Boilerplate AI-risk language has become exactly that: boilerplate.

This is not an isolated finding. Gartner predicted in June 2025 that more than 40% of agentic AI projects will be canceled by the end of 2027, citing escalating costs, unclear business value, and “agent washing” – chatbots relabeled as agents for the pitch deck. MIT’s Project NANDA went further: its 2025 State of AI in Business report, based on an analysis of 300 public AI deployments plus 52 executive interviews and a survey of 153 business leaders, found that 95% of generative AI pilots produce no measurable P&L impact despite $30 to $40 billion in enterprise investment. Three independent research efforts, three different methodologies, one converging answer: activity is not evidence, and the market – and now the researchers – have started telling activity and evidence apart.

Why the math got worse this year

Here’s where it gets uncomfortable. The CMU-Larridin effect was strongest, not among AI-native software companies where deployment is easy to verify, but inside the 285-company “physical-asset-heavy, late adopter” bucket – manufacturers, retailers, industrials – where AI claims are cheapest to make and hardest to check (n = 214, p = 0.025). That is precisely where most of the enterprise market sits.

And the SEC isn’t finished. AI-washing enforcement that started with two small advisers in 2024 has continued into 2026, and it maps onto the same variable the CMU-Larridin researchers isolated almost exactly: can you show your work? A regulator asking “prove it” and a market pricing “prove it” into your growth rate are the same test, arriving from two directions at once.

The architectural question

Stop asking whether your AI story sounds good. Here is the question that actually matters: if a regulator, an acquirer, or a reporter asked you tomorrow to produce the evidence behind your last AI claim – the system, the data it touched, who authorized that, and what happened – could you produce it by Friday, or would you be reconstructing it from memory and Slack threads?

Most organizations can’t. Kiteworks’ 2026 Data Security and Compliance Risk: Annual Survey Report found that 33% of organizations have no evidence-quality audit trail at all for their AI systems – and those organizations run 20 to 32 points behind on every other AI governance maturity metric measured. Fifty-one percent already have agents running in production. Sixty-three percent of those same organizations cannot enforce a purpose limitation on what that agent is allowed to do. Sixty percent cannot kill a misbehaving agent. The gap is not AI ambition. It’s proof.

This is an architecture problem, not a policy problem. A committee, a written AI policy, and a training deck do not generate evidence – they generate paper. What generates evidence is a system that logs, at the point of access, which identity (human or agent, same category) touched which data, under what authorization, and what it did next, in a format that survives being asked about eighteen months later. That is the design premise behind platforms like Kiteworks, which routes AI and human access to sensitive data through one policy engine and one audit trail rather than a dozen disconnected logs – not because Kiteworks invented the idea of evidence, but because “prove it later” has to be built in at the point data moves, not bolted on after an inquiry lands.

What to do Monday morning

1. Pull your last public AI claim – investor update, press release, sales deck. Does it name a specific system and a specific, quantified result? If not, that’s the same gap the SEC just fined two firms $400,000 over.

2. Ask whoever owns your AI or agent deployments to produce, this week, a log of every access to sensitive data by an AI system in the last 30 days – who or what accessed it, under what authorization. Time how long it takes. That’s your evidence-readiness number.

3. Stop scoring internal AI maturity by spend, vendor count, or headcount. None of the three predicted anything in the CMU-Larridin study. Score it by named use cases with quantified outcomes instead.

4. Compare your AI-risk disclosure language to a competitor’s. If a reasonable reader couldn’t tell them apart, rewrite yours – generic language no longer reads as maturity, it reads as absence.

5. Map one production AI workflow end to end: identity, data, purpose, authorization, action, destination, jurisdiction. If you can’t fill in all seven, you’ve found your actual risk, not the one in your slide deck.

The market has already started pricing the difference between AI you can prove and AI you can only describe. Regulators are just getting started doing the same thing.

That line is not my summary. It is the verdict stated in the 2026 Data Security and Compliance Risk Report about its own predecessor. In December 2025, Kiteworks published a Forecast Report built on 225 respondents and fifteen specific predictions about where AI data governance would stand in 2026. It predicted 100% of organizations would have agentic AI on the roadmap, with fewer than 40% holding any containment control capable of managing it. Five months later, the Annual Survey went back into the field with 459 respondents and measured what actually happened: 80% experienced at least one security incident of any type in the past twelve months.

I’ve read plenty of forecast-versus-reality reports over the years. Almost all of them find the forecast was too gloomy, because forecasts of this kind tend to assume the worst and reality lands somewhere more forgiving. Not this one. That is not a forecast that missed high. That is a forecast that undersold the exposure. Read that again: the report built to warn the industry turned out to be the optimistic version of events.

The verdict nobody at Kiteworks wanted to write

Every one of those fifteen predictions assumed some closing of the gap, because that’s what forecasts of this kind assume: organizations see the problem coming, budgets get allocated, controls get deployed, the number improves by the time anyone checks back. Six months is enough time to fix a checklist item. It is not enough time to fix an architecture. The Annual Survey checked, and almost nothing improved. Several things got measurably worse.

Here’s the whole game: this piece isn’t about a report being wrong. It’s about an industry that heard the warning, agreed with the direction, and still didn’t move fast enough to beat it.

Every line item moved the wrong direction

Look at the specific controls the Forecast flagged as the ones to watch, December against July:

AI kill switches: 60% lacking, then 70% lacking. Behavioral monitoring for AI systems: 60% lacking, then 69% – the detection deficit widened instead of closing, which is the opposite of what a maturing control environment is supposed to produce. Tamper-evident audit trails: 33% lacking in December, 67% lacking by July. Purpose binding – the control that restricts an AI agent to the task and data scope it was actually authorized for – 63% absent, then 74% absent.

One metric didn’t move at all, and that’s the one that should worry you most: 73% of organizations couldn’t produce a complete AI data access audit record within one business day in the Forecast. The Annual Survey found the same 73% unable to do it six months later. Flat. Zero progress on a control that DORA, NIS2, and the EU AI Act already expect to be operational.

Call it what it is: an optimism tax. The industry priced in improvement that never arrived, and now the gap is bigger than the number anyone budgeted against.

The boardroom never showed up

The strongest correlation in the entire Forecast Report was between board-level AI governance engagement and everything else measured: organizations where the board carried a standing AI data governance agenda item scored 26 to 28 points higher on AI maturity than organizations where it didn’t. The Forecast measured 54% of boards with no such agenda item. The Annual Survey measured the same 54%. Unchanged.

That’s a line item on a meeting agenda, not a budget request. Six months passed, and it still didn’t get added.

The gateway problem nobody closed

The Forecast identified centralized AI data gateways as the control that determines everything downstream of it – classification, purpose binding, audit capture, kill switch enforcement, all easier or harder depending on whether AI traffic runs through one governed point or scatters across a dozen ungoverned ones. It found 57% of organizations without one. The Annual Survey confirms the same picture from the other side: only 43% have achieved centralized AI gateway control. Same gap, six months apart, different survey.

Third-party AI vendor risk tells the same story with a different number attached. The Forecast found 89% of organizations had never practiced incident response with an AI vendor partner. The Annual Survey found 27% still haven’t even evaluated or technically verified whether their AI vendors train models on customer data. More than a quarter of organizations are handing sensitive data to AI vendors on trust alone, with no incident response plan behind it if that trust turns out to be misplaced.

And Government, which the Forecast called a generation behind – 90% lacking centralized AI gateways, 76% missing kill switches, 90% missing purpose binding – still posts the lowest maturity scores of any sector six months later. Federal Government and Defense Contractors haven’t moved off the bottom.

Here’s where it gets uncomfortable: none of this is a patching problem. You cannot bolt a kill switch onto an AI pipeline the week before an audit and call the 74% purpose binding gap solved. What the data describes is an architecture problem – AI data access running through as many paths as there are tools, with no single point where policy, logging, and containment get enforced consistently. That’s the premise behind the Kiteworks Control Plane, which I work on: one policy engine, running on single-tenant infrastructure, generating evidence-quality audit trails for every channel sensitive data moves through and every identity that touches it – human or agent, governed the same way, under the same plane. A gateway alone doesn’t fix a 54% board-engagement problem. But you cannot fix the board problem, the purpose-binding problem, and the audit-trail problem separately when they all run through the same ungoverned pipes.

What to do Monday morning

The Forecast told you what to fix in December. Most organizations didn’t. If you’re deciding where to start now:

1. Put AI data governance on the board agenda as a standing item, not a slide in the annual security review. The 26-to-28-point maturity gap tied to this habit hasn’t closed since December, and it costs nothing to fix.

2. Test your kill switch. 23% of organizations with AI in production have never tested theirs. An untested kill switch is a hope, not a control.

3. Get purpose binding in place before you add another AI use case. 74% absent means most of you are stacking capability on top of a control that doesn’t exist yet.

4. Route AI traffic through a centralized gateway before you audit anything else. Fragmented paths are why 67% still lack tamper-evident audit trails.

5. Verify, in writing, whether every AI vendor touching your data trains models on it. 27% of organizations still don’t know the answer to their own question.

Five months ago, we told you where this was headed. Nobody disputed the direction. The industry just didn’t move fast enough to beat it.

Read the full findings in the 2026 Data Security and Compliance Risk Report.

Picture the request. A regulator, an auditor, or a customer’s security team sends a one-line email: produce the complete AI data access audit record for the last quarter, by end of day. Not next sprint. Not “we’ll pull it together for the review.” Today.

Here’s what actually happens next, according to the 2026 Data Security and Compliance Risk Report: 83% of organizations cannot produce that record within one hour. Half cannot produce it within one business day. Ten percent cannot produce it at all – their logging infrastructure isn’t built to reconstruct what an AI system touched, no matter how long you give them.

Read that again. Ten percent of organizations, asked to show what their AI systems accessed, have no answer. Not a slow answer. No answer.

That’s the finding everyone should be arguing about, and almost nobody is. Instead, the industry conversation about AI governance still runs on model risk, bias audits, and responsible-AI charters – worthy topics, wrong emergency. The emergency is that most audit infrastructure was engineered for a world where you had days to respond to a request for evidence. The EU AI Act, ISO/IEC 42001, and DORA were built for a world where you have hours. That gap is not a future risk sitting on a roadmap somewhere. It’s the compliance posture you have right now, today, while you read this.

The One-Hour Test Nobody Passes

Only 17% of organizations can produce a complete AI audit record within one hour from existing dashboards, according to the report. Flip that number over and sit with it: 83% would fail if the request landed this afternoon.

This isn’t a story about organizations lacking a policy. Every company in this survey has an AI governance policy. Every company has an acceptable use document somewhere in a SharePoint folder that nobody has opened since the day it was approved. I have read a stack of these policies over the years. Not one of them generates a log.

The failure here is not documentation. It’s plumbing – whether the systems that actually touch AI data can produce a defensible, timestamped, complete record of what happened, to whom, and when. Fifty percent can’t do it in a day. Ten percent can’t do it at all. The policy document was never the control. It was the alibi.

Compliance Consequences Are Already Here, Not Coming

Sixty-three percent of organizations experienced at least one compliance consequence in the past 12 months, per the report – an audit finding, a required remediation plan, a board escalation, a contractual penalty, or a formal regulatory investigation. That is not a forecast about 2027. That is what already happened to two-thirds of the organizations surveyed, in the twelve months behind us.

And yet 7% of organizations have taken no action whatsoever on AI-specific regulatory requirements. None. Zero controls, zero governance changes, in a year when 63% of their peers got hit with a consequence severe enough to reach a board or a regulator.

The number that should worry a CISO more than either of the ones above: 61% of respondents rank AI-specific regulatory requirements in their top three compliance challenges, and 25% rank it as the single biggest challenge they face – more than any other item on the list, ahead of GDPR, ahead of PCI DSS, ahead of everything. Organizations know this is the hard problem. They rank it first. And they still can’t produce the record when asked.

Why “We Have a Policy” Doesn’t Survive Contact With a Regulator

ISO/IEC 42001 compliance is required for 40% of respondents in this survey. The EU AI Act imposes transparency, logging, and human oversight obligations that are enforceable now for high-risk system categories – not pending, not phased in on some horizon slide, active. DORA’s operational resilience obligations require financial entities to produce audit-quality evidence on short notice, and “short notice” in a regulatory context does not mean next quarter.

Here’s the whole game: an organization that cannot produce an AI data access record within one business day is not compliant with these frameworks’ audit obligations, regardless of what the policy document says. A binder full of governance language does not satisfy an auditor asking for a system-generated, timestamped access record from three weeks ago. Only one of those things is evidence. The other is homework you did to feel better.

And even where records exist, they may not survive scrutiny. Only 33% of organizations have tamper-evident audit trails – the specific evidence type investigators and auditors examine to confirm records haven’t been altered after the fact. The other 67% are exposed on any audit that requires evidence integrity, which is to say, any audit that matters. You can produce a log. Can you prove nobody touched it afterward? Two-thirds of you cannot.

The Architectural Question You’re Not Asking

The instinct here is to solve this the way security teams solve most gaps: add a dashboard, write a script that pulls logs from three systems into a spreadsheet before the auditor arrives. That approach is exactly what produced this problem. Only 40% of organizations apply a consistent evidence approach across all required compliance frameworks, per the report – meaning most are maintaining separate, ad hoc evidence trails for GDPR, the EU AI Act, ISO 27001:2022, and DORA simultaneously, reconciled by hand when someone asks.

That doesn’t scale to an hour-long deadline. It barely scales to a day-long one.

The architectural alternative is a single control plane that governs and logs data access, AI included, at the point of exchange rather than after the fact, across email, managed file transfer, SFTP, web forms, and API traffic alike. Kiteworks’ approach centers on exactly this premise: a hardened, single-tenant architecture that generates evidence-quality, tamper-evident audit trails as a byproduct of how data moves, not as a report someone assembles under deadline pressure. That same policy engine, the same audit trail, and the same evidence standard apply whether the identity accessing the data is a human employee or an AI agent acting on that employee’s behalf. An agent’s access produces the same defensible record a human’s does. Neither operates on the honor system.

That’s the difference between “we can eventually reconstruct what happened” and “here is the record, timestamped and unaltered, right now.” One of those satisfies DORA Article 19. The other satisfies nobody but yourself.

What This Means Monday Morning

1. Run the test yourself before a regulator does. Ask your team to produce a complete AI data access audit record right now, today, and time how long it actually takes.

2. Check whether your audit trails are tamper-evident, not just present. A log that can be edited after the fact is not evidence – it’s a story.

3. Map your evidence approach against every framework in scope simultaneously – ISO 27001:2022, GDPR, EU AI Act, DORA if applicable – and find out if you’re running one consistent evidence model or four incompatible ones stitched together by hand.

4. Assign ownership of AI audit readiness to a specific person with a specific deadline, not to “compliance” as a department.

5. Stop treating the policy document as the control. It never was. The system that produces the record on demand is the control.

The EU AI Act doesn’t care that your policy document is thorough. Neither does DORA. Neither does the auditor who emails you at 9 a.m. asking for the record by noon. The only question that matters is whether you can produce it, and right now, most of you cannot.

Read the full findings in the 2026 Data Security and Compliance Risk Report.

You know the DSMS number by heart even if you’ve never heard the acronym. Eleven controls – encryption, managed file transfer, SIEM integration, kill switches, the usual checklist. Your team has deployed four, maybe five of them. You feel reasonably good about that on a Tuesday. Then the 2026 Data Security and Compliance Risk Report hands you a new metric, the Data Security and Compliance Readiness Index, and your reasonably-good Tuesday gets worse.

Here’s the whole game: DSCRI is not another maturity score to stack on the pile. It’s a multiplication problem. And multiplication problems don’t forgive a zero anywhere in the equation.

What It Actually Is

The formula: DSCRI = DSMS × (AIGMS/100). Your Data Security Maturity Score – built from those 11 binary controls, normalized 0-100 – gets scaled by the fraction of AI Governance Maturity Score capabilities you’ve deployed. AIGMS measures 19 binary AI-specific governance capabilities: purpose binding, behavioral monitoring, AI-specific DLP, audit trail generation. Also normalized 0-100.

The survey mean DSMS is 39. The survey mean AIGMS is 35. Run the multiplication and the mean DSCRI lands at 16.2, with a median of 11.5. Half the organizations in this survey score below 12 out of 100 on organizational AI readiness. That’s not a rounding error in an obscure sub-metric. That’s the headline number a 459-organization sample produced when security maturity and AI governance maturity were forced to answer for each other simultaneously.

Here’s the part that makes the number bite: it’s multiplicative, not additive. An organization with a DSMS of 70 and an AIGMS of 20 doesn’t get credit for the 70. It gets a DSCRI of 14 – lower than an organization running a modest DSMS of 40 paired with an AIGMS of 45, which scores 18. Excellence in one dimension, unmatched in the other, gets discounted almost to nothing. That’s the design. It’s supposed to hurt.

The Market Reality

Only 19 respondents – 4% of the sample – broke the DSCRI midpoint of 50, and doing so required both DSMS and AIGMS to exceed 70 at the same time. Six respondents, barely 1%, cleared 70. The single highest scorer in the entire survey hit 84: a perfect DSMS of 100 paired with an AIGMS of 84, meaning 16 of 19 AI governance capabilities actually deployed, not planned, not budgeted – deployed.

Break it down by DSMS tier and the curve stops being gentle. Tier 1 Nascent organizations average a DSCRI of 2.0. Tier 2 Developing, 10.8. Tier 3 Established, 33.4. Tier 4 Advanced, 65.9. That’s roughly a 33-fold gap between the bottom tier and the top, and it isn’t linear – it compounds, because moving up a security tier only pays off in DSCRI terms if AI governance is climbing alongside it.

And the consequences aren’t theoretical. 74% of organizations in the survey experienced at least one general security incident. Among the 64% that had deployed AI, 64% experienced an AI-specific incident. Combine the two and 80% experienced at least one incident of either kind, with 63% facing a compliance consequence as a result. A DSCRI in the teens is what an incident rate like that looks like when you convert it into a single number.

Why the Math Got Worse

Here’s the part that should bother you more than the raw score does. At the survey mean DSMS of 39, raising AIGMS from 35 to 60 – deploying more of those 19 AI-specific capabilities – adds roughly 10 points to your DSCRI. Raising DSMS from 39 to 55 instead, bolting on four more general security controls while AIGMS sits untouched at 35, adds fewer than 6 points.

Read that again. It inverts the instinct every security budget in this survey seems to be running on. At current baselines, a dollar spent on AI governance returns more composite readiness than a dollar spent on general security controls. Not because general controls don’t matter. Because AI governance is the scarcer resource. You’re maxed out on the returns available from the side of the ledger everyone already knows how to fund. The multiplication is telling you where the marginal dollar actually works.

Most security roadmaps I see are still built almost exclusively around the DSMS side: more encryption, better SIEM tuning, another kill switch. Call it what it is. Governance debt – the AI capabilities the org keeps deferring while the general-security backlog gets funded first. All defensible on its own terms. None of it moves the number that’s actually predicting incident exposure, because the AI governance factor in that equation is sitting at 35 out of 100 and dragging everything above it down with it.

The Architectural Question

This is where the tactical response runs out of road. You cannot patch your way to a higher DSCRI by adding a twelfth control to an 11-control framework. The gap is architectural: most organizations have general-purpose security tooling that was never built to answer AI-specific questions – what a model touched, what an agent was authorized to do with a file, whether an inference request left an evidence-quality trail behind it.

That’s the premise behind the Kiteworks Control Plane – worth naming here, not as the fix, but as one example of what an architecture built for this problem actually looks like. A unified policy engine that governs data access, use, and exchange across email, MFT, SFTP, web forms, and APIs – for humans and AI agents alike, under the same rules, rather than a separate bolt-on for whichever AI tool showed up last quarter – is a different category of investment than a nineteenth binary checkbox. That distinction matters because AI data governance isn’t a feature you toggle on top of existing infrastructure; it’s a design decision, the same way FIPS 140-3 validated encryption is a design decision on the DSMS side. One platform doesn’t solve the equation. An architecture built to answer it does.

What to Do Monday Morning

1. Calculate your own DSMS and AIGMS separately before you calculate anything else. You need both halves of the equation, not a composite guess.

2. Stop routing the next security budget cycle exclusively at DSMS. If your AIGMS is anywhere near the survey mean of 35, that’s where the marginal dollar returns more.

3. Audit your AI-specific governance capabilities against the 19-capability list – purpose binding, behavioral monitoring, AI-specific DLP, audit trail generation. Most organizations in this survey have deployed under 7 of them.

4. Treat any DSMS-only “we hardened our security posture” claim from a vendor or an internal team as half an answer. Ask what it did to the other side of the multiplication.

5. Benchmark against DSMS tier, not just against peer spend. A Tier 3 organization with a stagnant AIGMS is still capped near a DSCRI in the low 30s, no matter how much more it spends inside Tier 3.

You cannot multiply your way past a zero. The organizations budgeting as if you can are the ones producing this report’s median score.

Read the full findings in the 2026 Data Security and Compliance Risk Report.

Picture this: it’s Tuesday morning, and a compliance manager at a mid-tier defense subcontractor is staring at a spreadsheet with 110 rows in it – the NIST SP 800-171 practices a C3PAO assessor will check line by line before the company can bid on its next DoD task order, formalized under the CMMC Program Final Rule at 32 CFR Part 170. Access control. Audit and accountability. Incident response. System and communications protection. Four categories, 110 controls, one outcome if the assessment fails: no CMMC certification, no contract. Not a strongly worded finding. A canceled bid.

That is the enforcement mechanism every other sector in the 2026 Data Security and Compliance Risk Report wishes it had. And it is the sector that scored the worst.

What the Numbers Actually Say

Defense Contractors post a Data Security Maturity Score (DSMS) of 15, the lowest of any of the ten sectors surveyed, more than 16 points below the survey mean of 39, and 28 points below Financial Services at 43.3.

Fifteen. Read that again.

Their AI Governance Maturity Score (AIGMS) is 22.8, also the lowest in the survey, nearly 12 points under the AIGMS mean of 34.7. Multiply the two and you get a Data Security and Compliance Readiness Index (DSCRI) of roughly 3.75 (DSMS 15 times AIGMS 25, divided by 100). That is the lowest composite readiness score of any sector measured.

One caveat, stated plainly because the report states it plainly: the Defense Contractors sample is three respondents. You cannot build an industry benchmark on n=3, and I’m not going to pretend otherwise. But three data points pointing the same direction, in the one sector facing a contractually enforced mandate, is not a number you get to wave off. It’s a flare.

The Company Defense Contractors Keep

Federal Government, the sector with the largest government-adjacent sample and no equivalent contractual teeth, doesn’t do much better. Its DSMS of 22.7 is the lowest among sectors with a meaningful sample size, more than 16 points below the mean. Its AIGMS of 25.4 is the second lowest in the survey. The Kiteworks Data Security and Compliance Risk: 2026 Forecast Report, published in December 2025, called Government “a generation behind”: 90% lacking centralized AI gateways, 76% missing kill switches, 90% missing purpose binding. Six months and 459 respondents later, the Annual Survey confirms the profile hasn’t moved – a stall consistent with the World Economic Forum’s Global Cybersecurity Outlook 2026, which found 87% of cyber leaders identified AI-related vulnerabilities as the fastest-growing cyber risk of 2025.

Here is where the conventional explanation runs out. Federal Government’s weak showing is easy to explain: AI governance there lives in policy memos, not contracts, and policy without enforcement rarely beats a budget cycle. Defense Contractors don’t have that excuse. CMMC 2.0 Level 2 is a flow-down clause in the contract, backed by third-party assessment and tied directly to award eligibility. If any framework in this survey should have forced maturity, it’s this one. It didn’t.

Why a Mandate With Teeth Still Isn’t Enough

The representation analysis makes the failure harder to argue away. Plot every respondent on a DSMS-by-AIGMS grid and you get four quadrants: leaders, two mixed profiles, and laggards. Zero Defense Contractor respondents land in the leadership quadrant. Zero. The sector’s laggard-quadrant representation index sits at 1.27, meaning contractors show up in the bottom-left corner well above their proportional share. Federal Government’s laggard index is worse still at 1.70, the highest of any sector with a meaningful sample, against a leadership index of just 0.25.

Here’s the whole game: a mandate without enforcement teeth fails to move behavior. That’s Federal Government, and it’s exactly what you’d expect from policy memos competing with budget cycles. But a mandate with real enforcement teeth is failing too. That’s Defense Contractors, and it is not what anyone modeling CMMC’s deterrent effect would have predicted.

Both are true. Both at once. And the second one is the finding that should worry you, because it means contractual teeth alone don’t guarantee behavior change – they just change what the failure costs you. Federal Government’s failure shows up as an audit finding or an IG report. A defense contractor’s failure shows up as a lost award. Call it enforcement without adoption – the mandate exists, the penalty is real, and the controls still aren’t there. That is a categorically different kind of exposure, and a DSMS of 15 says the sector has not internalized it yet.

The Architectural Question CMMC Doesn’t Answer

Here’s the part the compliance spreadsheet misses: 110 discrete NIST SP 800-171 practices, assessed individually, tempt organizations into a checklist mentality: prove each control exists in isolation rather than build one governance layer that enforces all of them coherently. Access control, audit and accountability, incident response, and system and communications protection are exactly the categories the DSMS measures across every sector in this survey, and they are the categories that fragment fastest when sensitive data moves across email, MFT, web forms, and a growing list of AI tools with no shared enforcement point.

This is the argument for treating CMMC 2.0 compliance as an architecture decision rather than a documentation exercise. It matters more now than it did two years ago: CrowdStrike’s 2026 Global Threat Report documents AI-enabled adversaries moving laterally in as little as 27 seconds, and Thales’ 2026 Data Threat Report finds only 47% of sensitive cloud-resident data is actually encrypted despite near-universal channel adoption. A checklist assessed once a year cannot keep pace with a threat that moves in seconds, across channels most contractors have never fully inventoried.

The fix isn’t another point solution bolted onto the 110-control checklist. It’s consolidating every channel that carries CUI and FCI – email, MFT, web forms, API traffic – under one policy enforcement layer with continuous, evidence-quality logging, so the audit trail a C3PAO wants already exists instead of getting assembled the week before assessment. Enforce the controls centrally and the checklist becomes a byproduct of the architecture, not the goal of it. That’s the difference between passing an assessment and never having to wonder if you would.

What to Do Monday Morning

If you sit inside a defense contractor, or anywhere in that supply chain, the DSMS of 15 is not someone else’s statistic. It’s a preview of your next assessment if your controls are as fragmented as the sector average suggests.

• Pull your own DSMS-equivalent tally now: how many of the 11 controls this report measures (encryption, DLP enforcement, SIEM integration, kill switches, and the rest) are actually deployed, not just documented.

• Map every channel carrying CUI or FCI – email, file sharing, MFT, forms, API – against a single point of policy enforcement, not seven.

• Ask whether your audit trail exists because a system generates it continuously, or because someone will assemble it manually the week before assessment.

• Treat purpose binding and access logging as contract-preservation controls, not nice-to-haves – they map directly to the access control and audit-and-accountability families a C3PAO will test.

• Stop treating CMMC certification as the finish line. The DSCRI of 3.75 says certification and actual readiness are not the same thing, and only one of them keeps the contract.

A mandate with real enforcement teeth just proved it isn’t self-executing. The gap between “we have a framework” and “we have the architecture that satisfies it” is still yours to close – and in this sector, the bill for not closing it isn’t a finding. It’s the contract.

Read the full findings in the 2026 Data Security and Compliance Risk Report.

On July 16, 2026, delegates from 29 countries gathered in Shanghai to launch the World AI Cooperation Organization, a new China-headquartered body meant to coordinate global AI governance. Indonesia, Brazil, Malaysia, Russia, Pakistan, Kazakhstan, and two dozen other states signed on as founding members. UN Secretary-General António Guterres showed up for the opening. Not one G7 economy did. Neither did the European Union.

That’s not actually the story. The story is what happened inside China’s own regulatory apparatus in the weeks around that launch. Four rule sets and one draft law arrived in a six-week window, and they apply to any multinational with a China subsidiary, a China-based vendor, or a banking relationship touching Chinese financial institutions, regardless of whether that company has ever sold a product inside China’s borders.

Here’s what I keep coming back to: global AI governance stopped converging toward a single standard this year. It’s splitting into competing blocs, and the fastest-moving one just wrote rules that reach past its own border and land on your desk anyway.

What Actually Changed in China This Summer

Start with the mechanics, because they’re more specific than most “AI regulation” coverage suggests. China’s Interim Measures for the Administration of Anthropomorphic AI Interaction Services took effect July 15, 2026, one day before WAICO’s launch. The measures require life-cycle risk assessment, ethics review, content monitoring, and incident-response programs for any AI service designed to simulate humanlike interaction. They also mandate a “minor mode,” guardian consent with spending and usage limits for users under 14, and an outright ban on virtual companion or virtual-relative services for minors, plus a ban on emotionally manipulative design generally. Several major Chinese platforms suspended roleplay and companion features rather than retrofit compliance in time. That’s not a symbolic response to a symbolic rule.

A month earlier, on June 18, China’s National Financial Regulatory Administration had issued its Guidelines on the Safe Development and Application of AI in Banking and Insurance: 32 principles under seven pillars. Banks and insurers now need risk-control-committee approval before deploying AI for high-risk use cases, cannot use personal information as AI training data, and must file any externally sourced AI model with the Cyberspace Administration of China.

Layered on top, the CAC published new Q&A guidance clarifying cross-border transfer mechanics: what a valid “separate consent” disclosure must contain, how the “necessity” test applies to routine transfers like a job candidate’s CV, and what conditions govern renewing an already-approved transfer. On July 29, China issued a draft national Anti-Cyber Violence Law for public comment, prohibiting deepfakes and profiling-based targeting used to harass. Barbara Li of Reed Smith laid out this whole sequence for IAPP’s Asia-Pacific coverage on August 6, 2026. Read together, it looks less like one policy announcement and more like a regulator tightening several fronts at once.

The Bloc Problem

WAICO matters more than a photo-op suggests. Twenty-nine founding member states, a permanent headquarters in Shanghai, a UN Secretary-General in the room. China’s state media covered the launch as a serious institutional milestone, and The Diplomat’s analysis treats it the same way. No G7 economy joined. No EU member joined.

That absence is the tell. AI governance isn’t converging toward one rulebook that the EU AI Act, the U.S. approach, and China’s framework eventually reconcile into. It’s splitting into parallel systems, and a bloc of large economies including Brazil and Indonesia is aligning with Shanghai rather than Brussels or Washington. If your supply chain, banking relationships, or data flows touch any of those 29 countries, you already stand inside more than one jurisdiction’s rulebook. Whether your compliance team has mapped that yet is a separate question.

Why the Math Got Worse

Fragmentation alone would be a headache. What makes 2026 different is that China’s new rules attach concrete, auditable evidence requirements to the fragmentation rather than leaving it as broad principle.

The NFRA banking guidance is the clearest example. “Don’t use personal information to train AI models” and “file externally sourced models with the CAC” aren’t awareness campaigns. They’re things a regulator can demand you prove, on a specific date, with a specific document trail. The CAC’s cross-border Q&A doesn’t loosen the substance of China’s transfer rules either. It removes the ambiguity that used to let companies argue their way through a gray area, which means clearer rules and fewer places to hide a gap.

This isn’t a China-only anxiety. Kiteworks’ Data Security and Compliance Risk: 2026 Forecast Report found 34% of organizations already cite cross-border data transfer mechanisms as a top regulatory priority, and 29% cite cross-border transfers through AI vendors as a top privacy exposure, and that’s before Beijing’s second, diverging rulebook even entered the picture. One genuine relief valve arrives September 1, 2026: companies processing personal data on fewer than 100,000 individuals qualify in China as “small-scale personal information handlers,” with simplified notice, consent, and longer audit cycles. Claiming that exemption still requires knowing your headcount against the threshold, so the classification work happens either way.

The Architectural Question

Kiteworks doesn’t sell into China, so there’s no vendor angle to spin here. The point stands on its own: the exposure created by this summer’s rules doesn’t depend on whether your company has a presence in China. It depends on whether data crosses that border at all, personal information, CVs, financial records, model training sets, through a subsidiary, a vendor contract, or a banking relationship. Company presence is the wrong unit of analysis. The data crossing the line is the right one.

That reframes the response. Chasing each new Chinese regulation with a policy memo doesn’t scale once you’re tracking WAICO-aligned states, EU rules, and U.S. state law at the same time. What scales is governing the data itself: classification that flags what’s in scope, geo-conditioned policy that acts on that classification automatically, and audit evidence proving the policy held. Regulators are increasingly asking for exactly this layer. It’s the same one the 2026 Forecast Report found 33% of organizations still lack in evidence-quality form, a gap tied to measurably lower AI-governance maturity across the board.

Concretely, that looks like an attribute-based data policy engine that conditions on a documented value (geolocation “is” or “is not” China, for instance) and applies a graduated response, block, require approval, tag, or view-only rendering, to send, share, upload, and attach actions across email, file sharing, APIs, SFTP, managed file transfer, and the Secure MCP Server that AI applications use to reach the data. Both the people and the AI agents touching a file sit under that same policy. Neither side goes unmanaged. A separate data sovereignty control that pins a user’s data to their assigned country, in storage and in transit, with built-in location reporting, gives an auditor something to examine besides a policy document. None of that requires operating in China. It requires governing the border the data crosses.

What This Means Monday Morning

• Map every data flow that touches China – subsidiary, vendor contract, banking relationship, even a candidate’s CV headed to a China-based recruiter – before assuming no China office means no exposure.

• Classify what’s moving: personal information versus operational data, training data versus everything else. The NFRA rule turns “was this used to train a model” into a question you need a documented answer to.

• Build a geo-conditioned policy for that corridor specifically, not a blanket block that breaks legitimate business.

• If you bank in China or rely on a China-sourced AI model, confirm your CAC filing status now; that NFRA rule is already in force.

• Before claiming the September 1 small-scale-handler relief, count. The exemption requires the classification work you should be doing anyway.

• Generate the audit evidence before a regulator asks for it, not after.

WAICO’s 29 members and the G7’s absence make a tidy geopolitics story. The rulebook fragmenting underneath it is the one your auditor will actually ask about.

Danielle Barbour writes on data governance and regulatory strategy for Zero Trust Data Exchange.

On July 28, 2026, security specialists at Switzerland’s Federal Office for Information Technology and Telecommunication (BIT) noticed something wrong on their on-premises SharePoint servers. Three days later, BIT confirmed that roughly 200 user and technical accounts had been compromised. Passwords reset, external access blocked -- then the servers came down entirely for a clean reinstall. By any reasonable standard, that’s a fast, competent incident response. No notes.

That’s not the story.

The story is that BIT did almost everything a security team is supposed to do -- detect quickly, contain same-day, patch, reset credentials, bring in outside help -- and still ended up disclosing 200 compromised accounts three weeks after Microsoft shipped the fix. If a well-run federal IT agency gets this outcome from a textbook response, “patch faster” was never going to be the control that saved you.

Two CVEs, One Attack Surface, 200 Accounts

BIT hasn’t confirmed exactly which vulnerability the attackers used, but the timeline points at one of two flaws Microsoft disclosed in its July 2026 Patch Tuesday cycle. CVE-2026-56164 is a missing-authentication flaw in on-premises SharePoint Server that lets an unauthenticated attacker escalate privilege remotely -- no credentials, no user interaction required. CISA added it to the Known Exploited Vulnerabilities catalog with a three-day remediation deadline for federal agencies.

The second candidate, CVE-2026-50522, is worse. It’s a deserialization flaw that gives a remote, unauthenticated attacker code execution on the SharePoint server -- and once inside, the documented objective isn’t data theft. It’s stealing the IIS machine keys that sign authentication tokens. BleepingComputer reported that watchTowr’s honeypot network caught exploitation attempts within hours of a public proof-of-concept going live on July 20. The Swiss agency’s own disclosure lines up with both flaws -- The Record noted BIT acknowledged the intrusion “presumably” exploited vulnerabilities patched that same month.

Two hundred accounts. One Patch Tuesday. Read that again.

This Is the Second Time in a Year

Here’s the part that should bother you more than the Swiss disclosure itself: this exact failure mode already happened in 2025. The “ToolShell” wave -- CVE-2025-49704, CVE-2025-49706, CVE-2025-53770 -- hit on-premises SharePoint Server through the same combination of authentication bypass and deserialization RCE. Palo Alto’s Unit 42 warned at the time that organizations exposing SharePoint Server to the internet should assume compromise, and that patching wouldn’t undo what attackers had already taken.

A year later, the mechanism repeated almost exactly: unauthenticated access, deserialization RCE, machine key theft. CERT-EU’s advisory on the July 2026 cluster put it plainly: “Given the number of recent critical vulnerabilities affecting SharePoint, organizations should reconsider exposing any Microsoft SharePoint Server directly to the internet.” Not “patch faster.” Reconsider the exposure.

This tracks with a broader pattern CrowdStrike documented in its 2026 Global Threat Report: adversaries are systematically targeting internet-facing, under-monitored infrastructure because patch cycles measured in weeks are mismatched against exploitation timelines measured in hours. SharePoint Server, sitting on-premises with a monthly patch cadence, is exactly that kind of target. Twice in twelve months isn’t a vulnerability. It’s a category.

The Patch Closes the Hole. The Keys Don’t Care.

Here’s what gets me about the machine-key detail: “we patched” doesn’t close the loop the way everyone assumes it does. When an attacker exploits a deserialization flaw to grab IIS machine keys, they walk away with the cryptographic material that signs and validates session tokens. As The Record reported, citing CISA’s guidance on the cluster: once stolen, those keys let an attacker forge legitimate-looking requests that a fully patched server will still accept. The patch fixes the door. It does nothing about the copy of the key already sitting in the attacker’s pocket.

Call it the eviction gap -- the space between “vulnerability patched” and “attacker actually gone.” It’s exactly why CISA and CERT-EU are both telling defenders to rotate machine keys and restart IIS rather than trust the patch by itself. BIT is reinstalling its affected servers from scratch instead of relying on a patch-and-rotate cycle. That’s the correct call. It’s also an admission that the patch was never going to be enough on its own.

It also explains why BIT’s language is so carefully hedged: “no indication” data was accessed beyond credentials, “analysis is ongoing.” That caveat isn’t evasive -- it’s honest. Kiteworks’ 2026 Data Security and Compliance Risk Forecast Report found that 61% of organizations are trying to build evidence-quality audit trails on top of fragmented infrastructure, and 33% don’t have one at all. When your proof of what an attacker touched depends on logs scattered across a general-purpose collaboration platform, “we found no evidence” and “we have no evidence to find” start to look the same from the outside.

Patching Fast Isn’t the Architecture Question

None of this means any specific vendor would have stopped this particular attack chain -- that depends on patch cadence, exposure, and configuration on any platform. But the July 2026 SharePoint cluster does surface the actual question every CISO running sensitive data through on-premises collaboration infrastructure should be asking, and it isn’t “how fast can we patch.”

It’s this: is your sensitive-data platform a general-purpose collaboration tool that got extended into data exchange over a decade, or was it built for governed data exchange from the start? On-premises SharePoint Server requires the customer to independently secure the authentication pipeline, manage the deserialization attack surface, and protect the IIS machine key store -- then repeat that exercise every Patch Tuesday. A platform architected around vendor-managed patching, isolated tenancy, and audit trails built to hold up as evidence rather than scattered log files shifts that ongoing burden off the customer’s side of the ledger entirely. That’s an architecture comparison worth having with your own vendors -- not a claim that unpatched CVEs are survivable everywhere else. Bring the comparison to your board before they bring it to you.

What to Do by Next Week

1. Inventory every internet-facing SharePoint Server instance in your environment today. If it’s exposed and unpatched against CVE-2026-56164 or CVE-2026-50522, treat it as compromised until proven otherwise -- not “vulnerable.”

2. Rotate IIS and ASP.NET machine keys and restart IIS on any server that was exposed before patching. Patching alone does not evict an attacker holding stolen keys.

3. Pull your audit logs and ask a hard question: can you produce a defensible timeline of exactly what was accessed, by whom, in the last 90 days -- or are you, like 61% of organizations Kiteworks surveyed, reconstructing it from fragmented logs across systems that were never built to talk to each other?

4. Separate regulated and sensitive workflows from general collaboration infrastructure. Not everything needs to move. The workflows carrying CUI, PHI, or contractual data are the ones that need a platform built for evidentiary-grade governance, not a platform that happens to store files.

5. Brief your board before a regulator or a reporter does it for you. Five CISA KEV entries and a national government disclosure in the same cycle is a board-level question, not a patch-ticket footnote.

BIT did the fast version of everything right and still had to reset 200 accounts and reinstall its servers from scratch. The lesson isn’t that Switzerland was careless. It’s that “patched” and “safe” stopped being the same word the moment machine key theft entered the playbook -- and if your sensitive data still lives on the same kind of platform, that gap is yours too.

Picture the CISO scorecard review at a mid-sized software company on a Tuesday morning. Encryption: deployed. SIEM integration: mostly there. MFT: locked down. The security team walks out of that meeting feeling good, and by the numbers, they should. Now picture the AI governance review two floors down, covering the copilot embedded in the codebase, the customer-facing support agent, and the internal chatbot employees have been pasting client data into since March. That review does not happen. Not because nobody scheduled it. Because almost nobody in Technology has built the muscle to run it.

That is the finding buried in the 2026 Data Security and Compliance Risk Report, based on 459 security, compliance, and technology leaders surveyed in Q2 2026. Technology’s mean Data Security Maturity Score (DSMS) is 40.7 – the second-highest of any sector measured, behind only Financial Services (43.3) and just ahead of Energy & Utilities (43.2) and Manufacturing (43.0). Its AI Governance Maturity Score (AIGMS) is 35.3, tracking almost exactly to the survey mean of 34.7. On paper, an above-average sector with an average governance posture. Read that again, because the paper is lying to you.

The quadrant that names the problem

The report’s DSMS × AIGMS framework sorts organizations into four profiles: Dual Exposure (weak on both), Foundation First (AI governance ahead of security, rare), AI-Ready (both strong, 11% of the survey), and one the report calls “False Confidence” – high DSMS, low AIGMS. Its one-line description of that quadrant: “Strong general security, no AI governance. Technology sector profile. Feels protected. Is not.”

Not implied. Named. Technology is the profile the framework was built to catch.

Here is where the aggregate numbers stop telling the truth. Despite that above-average DSMS, 65% of Technology respondents fall into the EXPOSED quadrant – DSMS below 50 and AIGMS below 50 simultaneously. Another 16% sit specifically in the FORTIFIED/False-Confidence pocket: strong security infrastructure, weak AI governance. Combined, that’s 81% of the sector sitting somewhere between blind and half-blind, propped up by a sector average that masks how unevenly the maturity is actually distributed. The mean flatters. The distribution convicts.

Sophisticated reputation, ordinary score

Here’s the uncomfortable part for anyone who has ever pitched Technology as the sector that “gets” AI. Its Data Security and Compliance Readiness Index – DSMS multiplied by the AI governance factor – comes in at 16.8, just above the survey mean of 16.2. Neither dimension distinguishes it meaningfully from an average organization. I’ve sat through enough of these scorecard reviews to know which number gets the applause and which one gets buried in the appendix, and it’s rarely the honest one. That gap between perception and measurement also shows up at the top: the World Economic Forum’s Global Cybersecurity Outlook 2026, published in January 2026, found 87% of cyber leaders now name AI-related vulnerabilities as the fastest-growing cyber risk, yet CEOs still rank data leaks as their single highest AI-related concern. Leaders can see the risk and still misjudge their own exposure to it.

And the representation analysis is worse than the readiness score. Across the survey, Technology produces DSMS/AIGMS “leaders” – organizations scoring 45 or above on both – at only 1.04 times the expected rate. Barely above proportional. Healthcare, a sector nobody nominates for a security award, produces leaders at 1.57 times the expected rate. The sector building the tools is not the sector governing them best. It is, statistically, an average performer wearing a sophisticated-industry costume.

Why the math got worse this year

None of this would matter much if Technology’s AI footprint were small. It is not. Across the full survey, 64% of organizations have AI deployed in production, and among those, 70% are running three or more distinct AI use cases at once. Copilots, customer-facing agents, internal chatbots, code-generation tools: each one is a separate data access point, and Technology, as the heaviest AI adopter in the sample, carries more of them than anyone else. It’s not a coincidence that the Thales 2026 Data Threat Report finds only 47% of sensitive cloud data is actually encrypted, and only one in three organizations claims to know where its sensitive data lives. Stacking AI use cases on top of a data estate you can’t fully see doesn’t produce governance. It just produces more surface you can’t see.

Here’s the whole game: containment has not kept pace with deployment, in Technology or anywhere else. No AI containment control measured in the survey – kill switch, purpose binding, AI-specific DLP, behavioral monitoring – is deployed by more than 35% of organizations, regardless of sector. Technology’s above-average DSMS buys encryption, MFT, and SIEM coverage for the data infrastructure it already understood. It doesn’t buy a kill switch for the agent nobody tested. CrowdStrike’s 2026 Global Threat Report clocked the fastest recorded eCrime breakout time at 27 seconds. Google Cloud’s Mandiant M-Trends 2026 report backs up the trend: the window to intervene has collapsed from hours to seconds. An untested kill switch doesn’t help at 27 seconds. It doesn’t help at 27 minutes either.

The architectural question

Two easy answers exist here, and both fail. The first is “Technology doesn’t need to worry, its DSMS is above average.” The quadrant data kills that outright: 65% exposed, a 16.8 DSCRI, a 1.04x leadership rate. The second is “just buy more AI security tools,” which treats the gap as a shopping problem. It isn’t. The report’s own math shows AI governance investment returns more DSCRI improvement per dollar than incremental security spend at current baselines, because DSMS and AIGMS sit on separate axes. You can’t buy your way up one with money spent on the other.

What actually closes the gap is architecture, not another point tool. Organizations that score well on both axes treat data access and AI governance as one control plane instead of two disconnected budgets: a single place where policy, logging, and containment apply whether a human or an AI agent is requesting the file, so an agent’s access gets reviewed and revoked using the same evidence trail as an employee’s. Technology has plenty of the data infrastructure and not enough of the AI-specific containment governing it. Closing that gap is an architecture decision, not a shopping list.

The Kiteworks 2026 Forecast Report, published in December 2025, projected this exact widening gap between AI deployment and AI containment. The Annual Survey confirms it arrived on schedule, and worse than modeled.

What to do Monday morning

If you run security for a Technology company, or any organization whose DSMS makes you feel comfortable, the scorecard review is not the meeting that matters this week. This one is:

1. Pull your AI use case inventory. If you have not counted every production AI system touching sensitive data, you cannot govern what you have not found. The report puts the sector average at three-plus concurrent use cases – confirm your own count before you assume it’s lower.

2. Test the kill switch you think you have. Across the survey, 23% of AI-deploying organizations have never tested their AI agent termination capability. A documented policy is not a tested control.

3. Separate the DSMS conversation from the AIGMS conversation in your next board update. If they’re one line item, they’re getting one budget, and one budget is how you end up in the False Confidence quadrant.

4. Check purpose binding, not just DLP. General DLP policies do not restrict what an AI agent is authorized to touch. That’s a distinct control, and most organizations don’t have it.

5. Ask who owns AI governance, specifically. Not “who owns security.” Who owns the 19 AI-specific capabilities the AIGMS actually measures.

Technology built the AI. That does not mean Technology governs it. The data says the opposite, and the data is not impressed by the reputation.

Read the full findings in the 2026 Data Security and Compliance Risk Report.

On August 4, 2026, IEH Corporation discovered that a phished Microsoft 365 credential had been sitting inside its network for an unknown stretch of time. IEH makes hyperboloid connectors that fly inside PATRIOT, AMRAAM, THAAD, and the MARK-48 torpedo. Here is what is not the story: an employee fell for a fake Microsoft sharing link from someone posing as a prospective business contact, and handed over their password. That happens constantly. Here is what is the story: for however long that account sat compromised, the entire contents of a defense contractor’s inbox were sitting in plaintext – purchase orders, engineering documentation, and potentially export-controlled technical data – one login away from anyone holding the keys.

IEH says it found no evidence the data was copied. It also says it cannot determine when access actually began. Sit with that for a second. A company that makes parts for missile defense systems cannot tell you how long an outsider had standing access to its correspondence with customers and suppliers. That is not a failure of this one IT team. It is the default behavior of every mailbox built this decade.

The Phishing Kit Got a Serious Upgrade

Credential phishing used to mean a bad Outlook lookalike page and hope. Not anymore. CrowdStrike’s 2026 Threat Hunting Report found device-code phishing attempts jumped 15-fold in the first half of 2026 compared to the second half of 2025, and voice phishing doubled in that same window after already climbing 134% the year before. These techniques exist specifically to slide past the controls organizations already bought. As CrowdStrike’s Adam Meyers put it to reporters: attackers realized email filters catch email phishing, so they stopped emailing and started calling the help desk instead. “You don’t have to hack in,” he said. “You just have to log in.”

That is precisely the move IEH’s attacker made. A fake sharing link, a convincing login page, one set of harvested credentials. No malware, no exploit, no CVE. Just a key that opened every door in the building at once.

Credentials Are Still Doing Most of the Damage

The 2026 Verizon Data Breach Investigations Report found the human element – error, manipulation, or misuse – involved in 62% of breaches this year, and credential abuse showed up somewhere in the intrusion chain of 39% of them, even as raw vulnerability exploitation edged ahead as the single leading initial-access vector. Read the two findings together and the story is not that credential theft is declining. It is that attackers increasingly pair a stolen credential with something else – a vendor relationship, an exposed system, a moment of trust – to get further than the credential alone would take them. IEH’s attacker did not need to go further. The mailbox itself was the whole prize.

The Login Moat Problem

Security teams keep fighting this the same way: better training, better MFA, faster detection. All of it targets the login. None of it addresses what happens once someone is past it.

Call it the login moat. Everything defensive gets built around the perimeter – the password, the MFA prompt, the conditional access policy – and once an attacker clears that single moat, there is nothing behind it. Not because organizations are careless, but because the mailbox itself was never designed to be anything other than a wide-open filing cabinet once you are inside. Native email platforms store messages and attachments as plaintext, and access control lives entirely at authentication. That architecture is fine right up until the authentication fails, and phishing guarantees it periodically will.

The Kiteworks Data Security and Compliance Risk: 2026 Forecast Report found only 39% of organizations have unified data exchange governance with actual policy enforcement across channels – the rest are running partial coverage, channel-specific point tools, or close to nothing. That gap is exactly where an incident like IEH’s lives: not in the phishing email, but in the fact that nothing downstream of the login screen was watching what left the building, or even watching what an authenticated session could see.

The Architectural Fix Nobody Wants to Talk About

The uncomfortable answer is that you cannot patch your way out of this. You have to stop treating the mailbox as a passive container and start treating it as a governed asset with its own policy layer, independent of whoever is currently logged in.

This is the premise behind email gateways built to enforce data-level policy rather than just scan for malware: encrypt or quarantine sensitive and export-controlled content automatically based on what it is, not who happened to send it; apply digital rights controls – view-only, expiration, no forwarding – so a compromised account cannot simply harvest years of correspondence; and log every message, sensitive or not, in an immutable audit trail that can actually answer “what did this account touch and when.” Kiteworks’ Email Protection Gateway is one example built on that premise, running inside a single-tenant hardened virtual appliance rather than a shared mailbox architecture – not because it is the only approach, but because it illustrates what “governed at the content layer” actually looks like in practice. The point is not the vendor. The point is that the policy has to live below the login, not just at it.

What to Do Now

1. Inventory what is actually sitting unprotected in your mailboxes right now – CUI, export-controlled data, contracts, engineering files. Most security teams have never run this exercise.

2. Move to phishing-resistant MFA, per CISA’s own guidance, not the push-notification kind that device-code and vishing attacks are specifically built to defeat.

3. Stop treating audit logging as a checkbox. If you cannot answer “how long was this account compromised” within hours, you have a logging architecture problem, not just a phishing problem.

4. If you are in the defense industrial base, map this exposure to CMMC 2.0 and ITAR now. That mapping matters more, not less, after the Pentagon suspended CMMC’s third-party assessment requirement on July 13 and reverted to self-assessment for the foreseeable future. No assessor is coming to catch what your own NIST 800-171 score misses.

5. Ask your security team one direct question: if a credential gets phished today, what stops the attacker from reading everything, not just logging in?

The next phished employee is not the risk. The unprotected inbox waiting for them is.

Here is a number that should ruin your morning coffee. CrowdStrike’s 2026 Global Threat Report documents AI-enabled lateral movement in as little as 27 seconds. Mandiant’s M-Trends 2026 report tracked the same collapse from a different angle: the median time from initial access to secondary threat group handoff fell from more than eight hours in 2022 to 22 seconds in 2025. Both figures show up in the 2026 Data Security and Compliance Risk Report, cited from those two source reports, and both describe the same event. Attackers do not need hours anymore. They need less time than it takes to read this paragraph.

Now put a second number next to it. Fifty percent of organizations cannot produce a complete AI data access audit record within one business day. Eighty-three percent cannot produce one within one hour. Ten percent cannot produce one at all.

Read that again. Twenty-seven seconds to compromise. A business day, or longer, to even find out what happened. That is not a gap. That is two different centuries trying to occupy the same network.

Here’s the Whole Game

Every AI governance conversation I sit in eventually drifts toward the same comfortable framing: “We’re closing the gap.” Boards like that phrase. It implies a plan, a timeline, a Gantt chart. It is also wrong, and it is wrong in a way that matters. You cannot “close” a 27-second exposure window with a governance program that convenes quarterly. Closing implies both sides are moving toward each other. They are not. The attacker’s clock keeps compressing – eight hours to 22 seconds in three years – while the average enterprise’s audit-response clock is still measured in days. This is not a gap to close. It is a structural mismatch between two systems operating on incompatible units of time, and no amount of incremental investment changes the unit.

The Control Built for This Moment Doesn’t Exist at Most Companies

An AI kill switch is exactly what it sounds like: the ability to sever an agent’s access the instant it misbehaves. It is the one control purpose-built for a 27-second threat window. Only 30% of organizations have one formally deployed. Seventy percent do not.

It gets worse before it gets better. Of organizations running AI in production, 23% have never tested the kill switch they have deployed. An untested kill switch is not a control. It is a rumor about a control, repeated in a compliance questionnaire until someone believes it.

Human-in-the-loop review for high-risk AI actions fares no better – deployed at only 30% of organizations, meaning 70% have no human checkpoint standing behind the missing automated one. So the honest inventory, for most companies, looks like this: no automated stop, no manual stop, and an adversary that closes the distance between “in” and “everywhere” in the time it takes to glance at a phone.

The Logging Infrastructure That Can’t Answer the Question

Containment gaps compound with visibility gaps. Only 37% of organizations have real-time alerting for AI data access anomalies. Only 33% forward AI access logs to a SIEM. Only 29% generate any logs of AI system data access at all. One in four organizations – 25% – has no formal AI detection process whatsoever.

Sit with that last figure. A quarter of the market has put AI systems into production against sensitive data and built no formal mechanism to notice when those systems touch something they shouldn’t. Not a slow mechanism. No mechanism.

None of this is speculative risk sitting on a heat map somewhere. Eighty percent of organizations experienced at least one security incident, general or AI-specific, in the past 12 months. The incidents already happened. The only open question is whether the organization found out in 27 seconds or 27 days.

Two Comfortable Answers, Both Wrong

Faced with numbers like these, organizations reach for one of two comfortable answers. The first: slow AI adoption until governance catches up. That fails on contact with the business – AI deployment is not waiting for anyone’s governance committee, and freezing rollout just delays the reckoning while competitors ship. The second: keep adding monitoring dashboards and call the accumulation “progress.” That fails on contact with the math. A dashboard a human checks on a schedule is still bound to human tempo, and human tempo cannot answer a 27-second question no matter how many dashboards you stack on top of it.

The real variable is not adoption speed and it is not dashboard count. It is whether containment and audit logging happen at the point of data access itself, automatically, or whether they happen afterward, manually, on a schedule a human set. That is the only variable that moves your response time from days to seconds.

The Architecture, Not the Meeting

This is where a unified data governance control plane earns its place in the conversation – not as a silver bullet, but as one working example of governing at machine speed instead of meeting speed. Kiteworks’ Control Plane applies one policy engine and one tamper-evident audit trail across every channel where sensitive data moves – email, managed file transfer, SFTP, web forms, APIs – and extends that same enforcement to AI agents, governing human and machine data access under a single plane rather than as separate, unevenly instrumented systems. The point isn’t the product category. It’s the principle: logging and containment have to be a condition of access, generated the instant data moves, not a report someone assembles after the fact. The Kiteworks 2026 Forecast Report called this exact containment gap the central battleground for 2026. It was right about the direction. This survey shows it was optimistic about the pace.

What to Do Monday Morning

Stop scheduling the meeting. Start doing this instead:

1. Test your kill switch this week. If nobody has fired it against a live agent session, you don’t have a kill switch. You have an assumption with a name.

2. Run a mock audit request today. Give your team one hour to produce a complete AI data access record for a single system. Whatever you get back, that’s your real number – not the one in last quarter’s board deck.

3. Check whether “real-time alerting” actually means real time. If AI access logs hit your SIEM on a batch job, you are in the 63% without it, regardless of what the dashboard says.

4. Put a human checkpoint in front of every high-risk AI action that doesn’t have one, as a stopgap while you build the automated version.

5. Retire the phrase “closing the gap.” It describes a process. What you have is a mismatch, and mismatches get fixed by architecture, not by patience.

Your attacker already reset the clock to 27 seconds. The only decision left is whether your governance runs on that clock or on the old one.

Read the full findings in the 2026 Data Security and Compliance Risk Report.

In December 2025, Kiteworks published the 2026 Data Security and Compliance Risk: Forecast Report, surveying 225 security and risk leaders. One finding stood out from the other fourteen: 54% of organizations had no standing AI data governance agenda item at board level. The report called it the strongest correlation in the entire survey – organizations with board engagement scored 26 to 28 points higher on every single AI maturity metric measured. Not a marginal edge. A structural one.

That was six months ago. The new 2026 Data Security and Compliance Risk Report surveyed 459 security and risk leaders in Q2 2026, explicitly built as what its authors call “the accountability document” – a test of all fifteen Forecast predictions against what actually happened. On board governance, the verdict lands in one sentence: 54%. Identical. Not directionally similar. The same number, to the point.

Here’s the whole game: this was never a measurement problem, a tooling gap, or a maturity curve that needed more time. It was a decision, made once in December and made again in June by simply not making it. Boards had six months, a named correlation, and a specific number telling them exactly what to do. They did not move.

The Best Control in the Survey Is Still a Minority Practice

Look at what “engaged” actually means before you assume your board clears this bar. Board-level AI data governance reporting as a standing agenda item – the highest-rated governance control in the entire survey – is present at only 46% of organizations that have deployed AI systems. Across all organizations surveyed, regardless of AI deployment status, that figure drops to 30%.

Read that again. The single best-performing control Kiteworks measured, out of nineteen AI governance capabilities, is still something most organizations don’t do. This isn’t a case of boards lagging behind a strong industry norm. There is no strong industry norm. There is a minority practice that happens to correlate with everything else going right, and a majority that has decided it can wait.

Boards Can Do This. They Choose Not To.

The excuse writes itself: boards are generalists, AI is technical, directors can’t be expected to govern what they don’t build. That excuse doesn’t survive contact with how boards behave on adjacent risk.

The National Association of Corporate Directors’ 2025 Public Company Board Practices and Oversight Survey found 77% of directors now discuss the material and financial implications of cyber incidents at the board level – a 25-point jump since 2022. Boards moved on cyber risk in three years. They have had AI data governance sitting in front of them, with a named correlation attached, for six months and haven’t moved at all.

So the capacity argument fails. Boards can absorb a technical risk category into standing governance when they decide it matters enough. On cyber, they decided. On AI data governance, at 54% of organizations, they haven’t.

Gartner’s own 2026 predictions forecast that 40% of enterprises will demote or decommission autonomous AI agents by 2027 because governance gaps only surface after a production incident. That is the cost of deferring the board conversation: you find out what you should have governed after it’s already broken.

Why This Is Getting More Expensive, Not Less

While boards sat still, the exposure compounded. The Annual Survey found 80% of organizations experienced at least one security incident – general or AI-specific – in the past twelve months, and 63% faced a compliance consequence: an audit finding, a remediation order, a regulatory investigation, or a board escalation that arrived only after something had already gone wrong. The World Economic Forum’s Global Cybersecurity Outlook 2026 puts data leaks at the top of CEOs’ AI-related concerns – which makes the board’s silence on AI data governance specifically, not AI generally, harder to explain away.

Ownership tells the same story from a different angle. Only 24% of organizations have a dedicated team for AI data governance. Thirty-nine percent bolt it onto an existing role – usually the CISO or CIO, who already owns general security, incident response, and now, apparently, AI governance too, without a board mandate or a budget line to match. IBM’s 2025 Cost of a Data Breach Report, produced with the Ponemon Institute, found 97% of organizations reporting an AI-related security incident lacked proper AI access controls, and 63% had no AI governance policy at all to stop it. The people closest to the problem know it. The people who set organizational priority have not said so.

The Architectural Question Boards Keep Avoiding

Here’s where it gets uncomfortable. A board agenda item is a governance decision, not a technology purchase – but it is also true that boards defer decisions when the underlying evidence is hard to produce. Ask a typical security leader for a complete AI data access audit record and half can’t deliver one within a business day. That is not a board failing to ask the right question. That is a board with nowhere to point when it does ask.

Architecture won’t make a board show up. But it can take away the excuse that the evidence doesn’t exist. A unified policy engine that governs how humans and AI systems alike access, move, and exchange sensitive data – built on a hardened, single-tenant architecture with evidence-quality, tamper-evident audit trails – gives a board something to review on a quarterly cadence instead of a status update built on trust. Kiteworks’ Control Plane is one example of a platform built on that premise. It doesn’t manufacture board accountability. It just removes the last excuse for not having it. The Annual Survey’s Mean AI Governance Maturity Score across all 459 respondents is 35 out of 100 – the average organization has deployed roughly 7 of 19 measured governance capabilities. That gap closes faster with a board paying attention than without one.

What to do Monday morning

1. Put AI data governance on the board agenda as a standing line item – not folded into general cybersecurity reporting, not addressed ad hoc when something breaks.

2. Bring the board a number, not a narrative: your AI Governance Maturity Score, your audit-record turnaround time, your percentage of AI systems with logged, reviewable access.

3. Assign dedicated ownership. If AI data governance is still an add-on to your CISO’s or CIO’s existing job description, name that as the gap it is, on the record, to the board.

4. Ask your board directly whether it has discussed AI data governance in the past two quarters. If the honest answer is no, that answer is now the first agenda item.

Six months bought this industry nothing. The next six are optional in exactly the same way the last six were: boards can keep choosing not to decide, or they can act on a correlation they already have the data to justify. The number doesn’t move on its own. Someone with a board seat has to move it.

Read the full findings in the 2026 Data Security and Compliance Risk Report.

Bans dropped 21 points in a year. Technical controls didn’t move. That’s not progress – that’s a policy department admitting defeat and calling it strategy.

Picture the memo. Some VP of Security Policy, sometime in late 2025, drafts an update to the acceptable-use policy. The line that once read “employees may not use unauthorized AI tools to process company data” quietly disappears. Nobody frames it as surrender. It gets filed under “modernizing our AI governance approach.” The all-hands slide says the company is “embracing AI while managing risk.” What actually happened is simpler: the ban wasn’t working, nobody built the thing that should have replaced it, and someone decided the cleanest fix was to stop having a rule that everyone was already breaking.

That’s not a hypothetical. It’s the finding.

The Cisco 2026 Data and Privacy Benchmark Study found that outright bans on AI tool usage fell from 28% of organizations in 2025 to 7% in 2026. Twenty-one points, gone in twelve months. Cisco found no corresponding rise in the technical controls that would need to exist for that retreat to be safe. Same study: enterprise AI usage more than doubled in 2025, and 62% of workers now use AI at work. Adoption accelerated. Governance did not follow it. Those two facts sitting next to each other are the entire story of this piece.

What actually happened while nobody was watching

Here’s the whole game: organizations didn’t defeat shadow AI. They ran out of the will to keep pretending the ban was enforceable, and quietly downgraded the problem from “prohibited” to “somebody else’s responsibility to notice.”

The 2026 Data Security and Compliance Risk Report puts a number on how much there is to notice. Sixty-five percent of organizations discovered employees using unapproved AI tools with organizational data in the past twelve months. Sixteen percent are finding it monthly or more. Twenty-eight percent quarterly. Twenty-one percent have caught it at least once, rarely. Add those up and you get an organizational habit, not an isolated incident.

The 35% who report no discovery at all deserve a second look, and not a reassuring one. Detection gaps and clean environments look identical from the outside. An organization with no logging on AI data flows and no alerting on anomalous transmissions will report zero shadow AI incidents right up until the breach notification arrives. Absence of evidence, in this specific case, is evidence of a blind spot.

The data isn’t generic, and that’s the part that should worry you

Shadow AI usage isn’t employees asking a chatbot to summarize a press release. Among organizations using employee-facing AI chatbots, 36% report customer and client data flowing through them. Thirty-three percent route IT credentials and access requests. Thirty-one percent route employee personal and HR data. Thirty percent route financial data.

Read that again. A third of these organizations have employees handing IT credentials to a consumer AI tool with no enterprise contract, no data processing agreement, and no audit trail. That’s not a training gap. That’s a data exfiltration channel that happens to be voluntary.

Why the response doesn’t match the exposure

Here’s where it gets uncomfortable. Discovering shadow AI and doing something about it are two different events, and the report shows most organizations stop after the first one. Among organizations that found shadow AI in use, the most common response was issuing updated policy guidance. Fewer than half went on to deploy technical controls that would actually prevent it from happening again.

Training keeps winning the budget argument anyway. Thirty-six percent of organizations name workforce training on AI data security as a top investment priority – the single most commonly planned response to a problem that training cannot structurally fix. An employee who has read the policy and still has an unblocked path to a consumer AI tool hasn’t been protected. They’ve been informed of a rule they remain fully capable of breaking, with documentation now proving they knew better.

The 2026 Cost of Insider Risks Global Report from the Ponemon Institute names shadow AI as the leading driver of negligent insider incidents, pushing average annual insider risk cost to $19.5 million per organization. That figure isn’t rising because employees got worse at following instructions. It’s rising because the instructions were never backed by anything that could stop the behavior.

The architectural question everyone is avoiding

Stop asking whether employees should be trusted to follow the updated AI policy. Here’s the question that actually matters: what, mechanically, stops sensitive data from reaching an unapproved AI tool if an employee decides to send it anyway?

For 72% of organizations, the answer is nothing. Only 28% have AI-specific data loss prevention deployed – the control that blocks sensitive data at the transmission layer instead of just documenting the violation after the fact. Purpose binding, which restricts AI agents and tools to authorized tasks and data scopes, is deployed at just 27%. Both numbers are governed the same way for human users and for the AI agents acting on their behalf – an unbound agent is exactly as capable of moving data somewhere it shouldn’t as an unsupervised employee, and neither has anything stopping them without a technical layer in place.

This is the point where the industry usually reaches for a policy fix, because policy fixes are cheap and fast to announce. But a policy is a sentence. A transmission-layer control is an architecture – something that inspects and blocks AI-bound traffic across every channel sensitive data actually moves through, rather than relying on a general-purpose network tool that was never built to recognize an AI destination in the first place. Detection after the fact is documentation. Enforcement at the transmission layer is the only thing that changes behavior that policy alone has already failed to change.

What to do Monday morning

The ban was never the control. It was a placeholder standing in for a control that most organizations never built, and now the placeholder is gone too. Here’s what closes the gap it leaves behind:

1. Pull your AI data access logs and check them for gaps, not incidents. If you have no real-time alerting on AI data transmissions, your “no shadow AI discovered” result measures blindness, not safety.

2. Map which of the four high-risk data categories – customer data, credentials, HR data, financial data – has an actual technical block in front of unapproved AI tools. If the answer is policy language instead of a control, you don’t have a mitigation.

3. Stop funding training as the primary response to a discovered shadow AI incident. Budget the transmission-layer control instead, and treat training as the secondary layer, not the first line of defense.

4. Ask your vendor governance team the blunt question: can we verify, technically, whether our approved AI vendors use our data for model training, or are we relying on a signed attestation we’ve never actually tested?

5. If your organization dropped its AI ban in the last year, find out what replaced it. If the honest answer is “updated guidance,” you didn’t modernize your policy. You repealed your only control and never built the next one.

Twenty-one points of bans disappeared in a single year. Zero points of technical control appeared to take their place. That’s not an evolution in AI governance. It’s a governance vacancy with a press release attached.

Read the full findings in the 2026 Data Security and Compliance Risk Report.

Here’s what a live red-team exercise just proved about what happens next.

It’s a Tuesday morning in February 2026, and a researcher at a security lab is about to break an AI agent using nothing but a Discord display name. Twenty researchers from MIT, Stanford, Carnegie Mellon, and Harvard spent two weeks running live, non-sandboxed agents built on the open-source OpenClaw framework, then attacked them the way a bored teenager would. One researcher renamed themselves to match an agent’s owner. The agent caught it instantly inside the channel it already knew. Then the same researcher opened a fresh private channel with no history attached, and the agent, faced with an identity it had no way to verify, handed over its memory files, its name, and its administrative access. No exploit. No malware. Just a display name.

Here’s the whole game: enterprises are deploying agentic AI faster than they are building any way to govern it, and the industry has quietly agreed to call this “early days” instead of what it is, which is a governance failure at scale. Agents will always outrun policy. That’s not a prediction, it’s a design fact, and every number below is just a different way of measuring the gap.

What the researchers actually found

The study, Agents of Chaos, documented at least ten significant security breaches across eleven representative case studies, and the pattern across them is not sophistication – it’s the absence of a stakeholder model. In one case, an agent refused a direct request for “the SSN in the email” but handed over the entire email, unredacted Social Security number and bank details included, when the same person asked it to forward the message instead. The agent could recognize an explicit ask for sensitive data. It could not recognize that the container holding that data was the identical exposure wearing a different hat.

The researchers call this a structural problem, not a bug. Large language model agents process instructions and data as the same kind of token in the same context window, which means the model has no reliable way to tell “do this” from “here is information” once both arrive in the same stream. Prompt injection isn’t a vulnerability you patch. It’s a property of how these systems currently work.

The pattern is bigger than one lab

If this were confined to one open-source framework, you could file it under “early days” and move on. It isn’t. CrowdStrike’s 2026 Global Threat Report tracked an 89% year-over-year increase in operations by AI-enabled adversaries and found attackers injecting malicious prompts into GenAI tools at more than 90 organizations, on top of abusing AI development platforms directly. The World Economic Forum’s Global Cybersecurity Outlook 2026 adds the enterprise-side mirror image: roughly a third of organizations have no process at all to validate an AI system’s security before deployment, and only about 40% run periodic AI security reviews once it’s live.

Put those two findings next to each other: an 89% jump in AI-enabled attacks on one side, 63% of organizations unable to enforce a purpose limit on their own agents on the other. Attackers are getting faster at exploiting AI systems. Most defenders aren’t checking whether their own AI systems are exploitable in the first place. That’s not a gap. That’s an open door with a welcome mat.

Why the math got worse this year

Governance debt on agentic AI has been accumulating quietly for two years. What changed is that agents stopped being a lab curiosity and became a procurement line item. The Kiteworks Data Security and Compliance Risk: 2026 Forecast Report found that 100% of surveyed organizations now have agentic AI on their roadmap. Sixty-three percent cannot enforce purpose limitations on what those agents do once deployed. Sixty percent have no way to terminate a misbehaving agent. Fifty-five percent cannot isolate their AI systems from the broader network if something does go wrong.

Read that again. Every organization surveyed is building toward agentic AI. Most of them have no brakes, no steering, and no wall between the car and the rest of the building.

Inside government specifically, the same report found 90% lack purpose binding for AI agents and 76% have no kill switch at all. That’s the sector with the most sensitive data and the least ability to stop an agent mid-task. The NIST AI Agent Standards Initiative, announced this February, names agent identity, authorization, and security as the priority areas for standardization. Standards bodies only move this fast when the field has already outpaced them.

The architectural question

The tactical response to all of this – write better system prompts, add a content filter, tell the agent to “be careful” – was never going to hold. You cannot patch your way out of a structural problem in how the model separates instruction from data. The fix has to sit outside the model, at the point where the agent actually touches a file, a folder, or a record, evaluating every request against policy the agent cannot argue its way around.

That’s the premise a small number of platforms are now building toward: treat the AI client as a governed identity, not a trusted one, and enforce the same role-based and attribute-based access controls on it that already apply to human users. Kiteworks’ Secure MCP Server is one example – it routes every AI request through a policy engine before data ever reaches the model, running on FIPS 140-3 validated cryptography, so the access decision, not the agent’s judgment, determines what comes back. For what it’s worth, we run this internally too: our own teams connect through the Connector day to day, which is a useful forcing function for finding the gaps in your own story before a customer does. It’s a narrow example of a broader architectural shift: governance has to move to the front of the request, for humans and agents alike, or it doesn’t count.

What to do this week

1. Ask your AI/ML team a direct question: can we terminate any deployed agent within sixty seconds, and can you show me the control that does it? If the answer is “we’d have to shut down the whole service,” you don’t have a kill switch, you have a hope.

2. Audit whether any AI agent in production has standing access to a data store, versus access gated per-request against RBAC or ABAC policy. Standing access is the CS8 failure mode waiting to happen with your data instead of a researcher’s.

3. Check whether identity verification for an AI client persists across sessions or channels, or resets to zero the moment context changes. If it resets, you have the same cross-channel gap the OpenClaw agents had.

4. Stop treating “the agent behaved correctly in testing” as evidence of anything. The Agents of Chaos researchers weren’t testing average-case behavior. They were looking for one counterexample, because demonstrating a vulnerability only takes one.

5. Put a number on your purpose-binding and containment controls this quarter, not next year’s roadmap. Sixty-three percent of your peers already can’t answer this question. Being able to is now a competitive fact, not a compliance nicety.

The agent that deleted its own memory files didn’t do anything an attacker forced it to do in the technical sense. It did exactly what it was designed to do: trust the identity in front of it. That’s the whole problem, and it’s the whole opportunity. Fix what the agent trusts, and you fix the incident before it has a chance to happen.

DataTribe published its Q2 2026 Insights Report on July 27. Two days later, Help Net Security ran the number that mattered: AI and agent security is now the single largest category of cybersecurity seed-stage investment, close to a quarter of every deal done last quarter. That is not the story. The story is why investors are suddenly this specific about it.

They are not funding “AI security” in the abstract. They are funding one mechanism: an agent that spins up a second agent, mid-task, and hands it live credentials – no verification, no scoping, no log. DataTribe found roughly a quarter of deployed agents can do this today. Read that again. A quarter of the agents already running in production environments can silently create a new, unaccountable identity and give it the keys.

The Number Investors Actually Priced

Here’s the whole game: DataTribe measured every control in its dataset for impact on incident rates, and one control beat all the others by a wide margin. Scoping agent privileges to least-privilege access took incident rates from more than two-thirds of deployments down to below 20%. Not a modest improvement. A collapse.

That is what seed money is chasing – not agent security as a category, but the specific, provable lever inside it. Everything else investors funded this quarter is downstream of that one finding.

The Handoff Nobody Is Watching

Call it silent succession: an agent, mid-task, creates a subordinate agent and passes it working authority without telling anyone. No identity provider checks who the new agent is. No policy engine scopes what it can touch. No log records that the handoff happened at all.

This is not a hypothetical. It is the mechanism DataTribe is describing when it says a quarter of deployed agents can spawn sub-agents and hand off live credentials with no verification, scoping, or audit trail. The sub-agent inherits whatever access its parent happened to be holding, which is almost always broader than the actual sub-task requires. Nobody approved that grant. Nobody is accountable for it. It just happened, in milliseconds, because the architecture allows it.

Kiteworks’ own Data Security and Compliance Risk: 2026 Forecast Report found 60% of organizations cannot terminate a misbehaving AI agent once it is running, and 63% cannot enforce purpose limitations on what an agent is allowed to do in the first place. Those two numbers explain why silent succession works as an attack path. You cannot scope what you cannot see, and you cannot kill what you have no switch for.

Why the Math Got Worse This Quarter

None of this would matter as much if defenders still had time to notice. They don’t. DataTribe cites CrowdStrike’s 2026 Global Threat Report, which puts the fastest observed breakout time this year – initial compromise to lateral movement – at 27 seconds.

Twenty-seven seconds. That is not a detection window. That is barely enough time for a SOC dashboard to refresh. A human analyst cannot triage an alert, rule out a false positive, and contain an incident inside 27 seconds. Nothing built around “detect, then respond” survives contact with that number.

Meanwhile the old front door hasn’t closed. Verizon’s 2025 Data Breach Investigations Report found edge device and VPN exploitation rising sevenfold. So attackers are getting through the perimeter faster than ever, and once inside, they are increasingly finding unscoped, unlogged agent identities waiting for them. Fast entry plus ungoverned agent sprawl plus a 27-second window is not three separate problems. It’s one compounding one.

The Architectural Question

Here’s where it gets uncomfortable for anyone still thinking about this as a detection problem. If breakout happens in 27 seconds and a quarter of your agents can silently mint new identities with inherited access, faster alerting does not save you. The only control that acts inside that window is one that was already in place before the agent asked for anything.

That means the fix has to live at the point of the request, not at the perimeter and not in a SIEM dashboard after the fact. Every time an agent – or a sub-agent it just created – asks to touch a file, a record, or a dataset, something has to evaluate that specific request against policy before access is granted, and log it regardless of the outcome. This is the architectural bet a handful of vendors are making, Kiteworks among them: a unified policy engine that enforces per-request RBAC and ABAC for both human and agent identities under one plane, so a sub-agent inherits governance the moment it’s created instead of inheriting whatever access its parent happened to be holding. It is one example of the pattern, not the only one, and it does nothing for the edge and VPN exploitation Verizon is describing. Perimeter hardening and content-layer governance are two different budget lines that need to move together.

What to Do This Week

1. Inventory which of your deployed agents can spawn sub-agents. Most security teams cannot currently answer this question. That is the actual gap, not a lack of tooling.

2. Require that any sub-agent creation event triggers its own identity verification and scoped credential issuance – never inherited, unscoped access from the parent.

3. Confirm you have a working kill switch. If 60% of organizations can’t terminate a misbehaving agent, assume you’re in that group until you’ve tested it.

4. Push least-privilege scoping to the top of the AI governance roadmap, ahead of general AI policy work. It is the only control DataTribe measured that cut incident rates by two-thirds.

5. Stop treating this as a perimeter problem or a content-governance problem. It is both, funded from the same conversation, on the same timeline.

Venture capital isn’t betting on agentic AI security because it sounds forward-looking. It’s betting on it because DataTribe just showed the industry which control actually works, and most enterprises haven’t installed it yet. That gap is not a research question anymore. It’s a Monday morning task list.

Picture a Tuesday morning in July 2026: your patch dashboard has already ranked forty new CVEs by exploitability, and the AI did that ranking overnight, unsupervised, while you slept. All that is left is one click: deploy across production. You do not click it. Neither would 53% of your peers, according to Action1’s newly released 2026 Survey Report: AI Impact on Sysadmins. Two years ago, this same population told researchers that by now AI would be running patch management, vulnerability prioritization, and incident response with minimal human involvement. It is not. And the reason has nothing to do with whether the models got good enough.

What Sysadmins Actually Said

Start with the number that should embarrass every AI roadmap slide from 2024: fewer than one in five sysadmins currently use AI for patch management or vulnerability prioritization – the two workflows they themselves flagged as most automatable. Twenty-three percent said they have never used AI professionally at all. Not “rarely.” Never.

Then look at where trust actually breaks. Only 14% would let AI deploy patches across production systems without supervision. Just 11% would let AI override an existing patching policy under any circumstance, and 40% said they never would. Sysadmins will let AI schedule maintenance windows and triage alert noise. They will not let it touch the thing that keeps the business running, unwatched.

Here is the sentence in the report that matters more than any of those percentages: when AI acting on file or identity management makes an error, accountability for the resulting harm is left ambiguous. Read that again. The industry has spent two years debating whether AI is capable enough. Nobody built the part where someone is on the hook when it is wrong.

The 2024 Predictions Didn’t Miss. They Inverted.

AI did not fail to keep pace with a 2024 roadmap. A different fear just won out. Back then, sysadmins worried the technology would mature too slowly. Now the worry has flipped: it matured fast enough to act, not fast enough to be trusted with the blast radius of that action.

That fear is not isolated to IT operations. IBM’s 2026 Cost of a Data Breach Report, based on Ponemon Institute interviews with staff at more than 600 breached organizations, found that among organizations reporting an AI-related security incident, 92% were missing basic role-based access controls, MFA, or equivalent safeguards on the AI systems involved. Fewer than half of organizations secure the non-human identities their AI workflows depend on. Close to seven in ten of those breached organizations lack governance policies for AI use at all. The sysadmin who will not let a model touch production unsupervised is not being a Luddite. He has seen the breach data the rest of the industry is still catching up to.

Why the Math Got Worse, Not Better

Two years ago, “AI in IT operations” mostly meant a chatbot summarizing logs. In 2026, it means agents with standing access to systems, credentials, and file stores – acting continuously, not on request. That shift changes the risk calculus entirely, and a separate 2026 survey from 1Password of 1,000 security and engineering staff at large U.S. firms shows exactly how. Seventy-one percent said their AI agents can reach sensitive information. At roughly four in ten organizations, agents reach data outside what was ever approved for them – agents touched, on average, twice as much data as anyone had signed off on. Forty percent of developers grant agents persistent access that outlives the task. One in three respondents who use agents reported a breach or incident tied specifically to overprivileged non-human identities.

Then ask who answers for it. In that same survey, 65% of respondents said accountability should sit with someone other than whoever is currently assigned it. Five percent said the agent itself should be accountable. An agent cannot be fired, sued, or deposed. That five percent is not an edge case. It is what happens when an organization deploys autonomy faster than it defines ownership.

Gartner has already priced this in at the portfolio level: it predicts more than 40% of agentic AI projects will be canceled by the end of 2027, largely on escalating costs and inadequate risk controls. The sysadmins in the Action1 survey are not lagging the roadmap. They are the roadmap correcting itself.

The Architectural Question

Here is the question I keep coming back to: why does every conversation about AI trust default to “is the model good enough” instead of “can we see and constrain what it just did?” Those are different problems, and only one of them has a mature answer today.

Faster patch algorithms do not close an accountability gap. Better prompts do not either. What closes it is treating every AI action – human-initiated or agent-initiated – as a governed, logged request against a defined policy, the same way you would treat a privileged employee action, not as a separate autonomous actor operating outside the rules humans follow. A handful of vendors are starting to build access-governance layers on exactly that premise: a single policy engine that enforces per-request rules on what any identity, human or AI agent, can actually reach, and that logs each request in an audit trail detailed enough to survive a post-incident investigation. None of that makes an AI model trustworthy on its own merits. It makes an organization’s exposure visible and provable when the model gets it wrong, the exact accountability layer the Action1 and 1Password data show is missing. One boundary matters here, though: that kind of access governance covers content and credential access, not the IT operations task of pushing a patch to a production server. Those are neighboring problems, not the same problem, and Kiteworks’ own 2026 Data Security and Compliance Risk Forecast Report tracks them separately for that reason.

What This Means Monday Morning

1. Pull your own numbers before you argue with the sysadmins. What percentage of your patch, vulnerability, and identity workflows actually touch AI unsupervised right now? Most teams do not know.

2. Write down who is accountable for an AI-driven access error before one happens, not after. If your answer is “the vendor” or “the model,” you have the same gap 65% of the 1Password respondents flagged.

3. Separate the two governance problems on your roadmap: operational autonomy (should AI deploy the patch) and data access governance (what can the agent touch while doing anything). Different controls, different owners, different timelines.

4. Audit non-human identities the way you audit privileged human accounts – expiration, scope, logging – because fewer than half of organizations currently do, per IBM’s 2026 data.

5. Demand an audit trail before you demand autonomy. The sysadmins already figured this out. The rest of the industry is still arguing about model capability.

The gap was never between what AI could do and what sysadmins would let it do. It was between what AI could do and what anyone could prove it did.