Share with your CISO
Kiteworks’ 2026 Data Security and Compliance Risk report puts a number on a problem most CISOs already feel: 80% of surveyed organizations suffered at least one security or AI-related incident in the past year, and 63% faced formal compliance consequences as a result. The average AI Governance Maturity Score landed at 35 out of 100, and the combined readiness index at just 16.2. No AI containment control surveyed had been adopted by more than 31% of respondents. Shadow AI is the accelerant: 65% of organizations found employees routing sensitive data through unauthorized AI tools.
What this means for your business
The 19% of organizations Kiteworks classifies as “Resilient” scored an average combined readiness index of 46; the 66% labeled “Exposed” averaged 8. Same industries, similar sizes, radically different outcomes. What separates them isn’t budget or sector, it’s whether controls are actually deployed rather than documented. If your AI governance program lives primarily in policy PDFs and awareness training, this report is describing your organization, not a cautionary peer.
The most counterintuitive finding is worth sitting with. At the survey’s average security maturity score, improving AI governance from 35 to 60 nearly doubles the readiness gain you’d get from adding four traditional security controls. That’s a resource allocation argument, not just a compliance one. Most security budgets are still weighted toward perimeter and endpoint controls built for human actors. Agentic AI systems, autonomous software that acts on data without a human approving each step, don’t respect those boundaries, and the controls weren’t designed for them.
Half of organizations can’t produce a complete AI data access audit trail within one business day. Under DORA, NIS2, and the EU AI Act, that’s not a gap you can remediate after a regulator asks. The organizations that closed this exposure didn’t do it by hiring a governance lead or writing an AI use policy. They did it by building audit capability into the data layer before regulators came looking. The falsification condition here is simple: if your organization can pull a full AI data access log in under 24 hours today, this report’s urgency doesn’t apply to you at the same intensity. Most can’t.
Concept deep-dive: Shadow AI
Shadow AI refers to AI tools employees adopt and use independently, outside IT visibility or approval, to handle work tasks. Think of it as the 2025 version of shadow IT, when workers started using Dropbox before the enterprise had approved cloud storage. The difference is that AI tools process and sometimes retain sensitive inputs. Among organizations that detected shadow AI use, 36% found customer data had been processed through unauthorized tools, creating compliance exposure the organization didn’t know existed until after the fact.
Based on reporting from Kiteworks Report Reveals 80% of Organizations Experienced Security or AI Incidents as AI Governance Readiness Remains Critically Low, originally published 2026-08-03 06:20:00.
