AI is now embedded in the vast majority of enterprises.
That’s not a projection. That’s today’s reality.
But universal AI adoption hasn’t been matched with universal control.
The same benchmark that confirms AI’s rapid integration across enterprise environments also reveals a more sobering truth: most organizations are securing AI with tools, processes, and governance models that were never designed for it.
The AI Security & Exposure Benchmark 2026, based on a survey of 300 U.S. CISOs at organizations with 3,000+ employees, cuts through the hype to show where enterprise AI security actually stands. It also shows where risk is accumulating the fastest.
From our work with midmarket and enterprise organizations, these findings aren’t surprising. What is new is the scale. AI now sits at the intersection of data, identity, APIs, and cloud infrastructure, often without the visibility, ownership, or validation traditionally applied to those layers.
Here’s what the data says, and what it means for security leaders navigating this new reality.
Key takeaways:
- 67% of CISOs have limited visibility into their AI ecosystem, and even those with “good” visibility expect Shadow AI to exist.
- 75% of enterprises rely on legacy security tools (endpoint, cloud, API security) to protect AI systems, rather than purpose-built AI security tooling.
- 50% of CISOs cite lack of internal expertise as their #1 barrier to securing AI, above budget concerns.
- At least 75% of enterprises experienced a cyberattack in the past 24 months.
- 70% of CISOs plan to increase penetration testing budgets in 2026.
AI is everywhere. Visibility is not.
Every CISO surveyed reports some level of AI adoption. But adoption and oversight are not the same thing.
67% of CISOs say they have limited visibility into where and how AI operates across their environment. The remaining 33% report “good” visibility yet still acknowledge Shadow AI is likely present. Not a single CISO reported full visibility with zero Shadow AI.
In practice, this means AI systems are being deployed faster than security teams can inventory, govern, or test them. Business units embed AI into workflows, connect models to sensitive data, and automate decisions, often without formal approval or centralized oversight.
This is the essence of Shadow AI: AI used inside an organization without formal governance from IT, security, legal, or leadership. And according to this benchmark, it’s no longer an edge case. It’s the norm.
The risk isn’t theoretical. When AI systems have access to sensitive data, identity systems, APIs, and cloud infrastructure, without clear governance, enforced ownership, and continuous validation, the blast radius of an undetected compromise becomes exponential.
You can’t protect what you can’t see. And with AI, unseen exposure compounds quickly.
Legacy tools are carrying the load. That’s a strategic problem.
When asked how they’re securing AI, most enterprises report relying on the tools they already have.
75% of CISOs say they use existing non-AI-specific tools, endpoint security, cloud security, application security, API security, to cover their AI ecosystem. Only 11% use security tools purpose-built for AI systems.
This mirrors a familiar pattern. Early in cloud adoption, organizations attempted to extend on-premises controls into cloud environments. That approach worked—until it didn’t. The attack surface was fundamentally different, and purpose-built controls eventually became unavoidable.
AI is following the same trajectory.
The challenge isn’t just technical. Relying on legacy controls to secure AI is also a governance failure. Traditional tools weren’t designed to answer foundational questions like:
- Who owns an AI system end-to-end?
- What data and identities does it have access to?
- How is its behavior validated over time?
The good news: 64% of CISOs are actively evaluating dedicated AI security tools. The transition is underway. But until governance and validation catch up, organizations are carrying real, measurable risk.
The real barrier isn’t budget; it’s expertise.
When CISOs were asked to identify their biggest obstacles to securing AI, the results were telling:
- 50% cited lack of internal expertise.
- 48% cited limited visibility into AI usage.
- 36% cited lack of dedicated AI security tools.
- 30% cited unclear testing methodologies.
- Only 17% cited budget constraints.
Budget isn’t the bottleneck. Capability is.
Organizations are struggling to assess AI risk, define ownership, implement appropriate controls, and validate AI security in a consistent way. This aligns with broader industry research: the 2025 ISC² Cybersecurity Workforce Study identified AI as the most in-demand skill among security professionals, cited by 41% of respondents.
In this environment, the question isn’t whether organizations should build AI security expertise. It’s whether they can afford to wait while attackers move faster than internal capability development.
Fragmented ownership creates predictable gaps
Another finding should give security leaders pause: 56% of enterprises say AI security is owned across multiple teams as a shared responsibility.
Shared responsibility sounds reasonable in theory. In practice, it often means no single team has end-to-end accountability.
AI security spans identity, data, applications, APIs, and cloud infrastructure. When ownership is fragmented across security, IT, and application teams, without clear authority, gaps are inevitable.
Only 20% of enterprises place AI security fully within the security team. Another 16% assign it to IT or infrastructure. Just 6% rely on third-party providers.
Without clear ownership, consistent governance and effective response become nearly impossible.
Breaches are common, even with expanding security stacks
Here’s the number that should stop executives in their tracks:
At least 75% of U.S. enterprises experienced an attacker inside their environment in the past 24 months.
These organizations aren’t under-resourced. On average, they spend $2.48 million annually on cybersecurity. Yet breaches remain common.
More tools don’t automatically mean better security. In fact, complexity often works against teams, introducing more alerts, more integrations, and less time for meaningful investigation.
What does correlate with confidence? Validation.
Organizations that conduct quarterly penetration testing report significantly higher confidence in their AI security posture than those testing annually. Testing doesn’t just find vulnerabilities; it replaces assumptions with evidence.
Penetration testing is expanding, and AI is driving it
Security leaders are responding accordingly.
70% of CISOs plan to increase penetration testing budgets in 2026. AI-driven risk is a major factor. More than half of enterprises already include AI-specific scenarios in their offensive security programs, such as:
- AI-generated phishing and impersonation attacks
- Prompt injection and LLM manipulation
- Abuse of over-permissioned AI identities and services
- Unauthorized use of public or third-party AI tools
CISOs aren’t waiting for perfect frameworks. They’re validating exposure in real time, because attackers already are.
What CISOs can do right now
Based on the benchmark and our experience, five actions matter most:
- Get visibility before you get tools.
You can’t govern what you can’t see. Start with a comprehensive inventory of AI systems, sanctioned and unsanctioned, and map what they can access across data, identity, APIs, and cloud infrastructure. - Establish clear ownership.
Shared responsibility without accountability is a liability. Assign AI security ownership with the authority to enforce controls and drive remediation. - Implement AI governance as your security control plane.
Governance isn’t bureaucracy. It defines data boundaries, permissions, approved use cases, and acceptable risk, before AI scales across the organization. - Test your AI attack surface.
Assumptions don’t hold up against AI-enabled attacks. Incorporate AI-specific scenarios into penetration testing to understand what’s actually exploitable. - Close the skills gap with the right partner.
If internal expertise isn’t there yet, waiting isn’t a strategy. The threat landscape won’t slow down.
The bottom line
AI adoption is no longer optional. But unsecured AI is an open invitation.
The AI Security & Exposure Benchmark 2026 makes one thing clear: visibility is limited, ownership is fragmented, and legacy tools are stretched beyond their design. Most enterprises have already felt the impact.
The organizations that succeed with AI won’t be the ones with the most tools. They’ll be the ones with clear ownership, enforced governance, and continuously validated defenses.
Those organizations won’t just be more secure. They’ll be more confident. And better positioned to unlock everything AI has to offer.
