GenAI security statistics show governance is lagging adoption

At a glance

What this is: This Knostic statistics roundup shows that GenAI adoption is outpacing governance, with measurable exposure in prompts and uploads, frequent prompt-injection bypasses, and a staff-readiness gap.

Why it matters: IAM and AI security teams need these figures to decide whether policy, identity controls, data controls, and incident response are actually keeping pace with GenAI use.

By the numbers:

• 4% of prompts to GenAI tools contain sensitive corporate data, according to Knostic.
• Over 20% of files uploaded to GenAI tools contain sensitive corporate data, according to Knostic.
• 56% of prompt injection tests across 36 LLM configurations successfully bypassed safeguards, according to Knostic.
• 75% of companies have AI policies, but fewer than 60% have trained governance staff or incident-response capabilities, according to Knostic.

Context

GenAI security is now a governance problem, not just a model-safety problem. Once employees can move prompts, files, and outputs through AI tools at work, traditional DLP and access reviews no longer cover the full data path.

Knostic’s statistics point to a familiar pattern in identity programmes: adoption scales faster than enforcement. The question is no longer whether organisations have AI rules, but whether they can prove those rules are being enforced at the point of use.

The article’s central finding is that control maturity is lagging behind actual GenAI usage, which is typical for early deployment phases and atypical only in how quickly the exposure is compounding.

Key questions

Q: What breaks when GenAI policies exist but trained governance staff do not?

A: Policies without trained staff usually fail at the point of enforcement. The organisation may know what it wants users to do, but it lacks the owners, playbooks, and escalation paths to act when prompts, uploads, or outputs violate that policy. The result is documented intent without operational control.

Q: Why do prompts and file uploads create more AI data risk than traditional repositories?

A: Because they place sensitive content directly into a live AI workflow where it can be processed, summarized, or echoed back outside the normal storage controls. That means risk exists at the moment of interaction, not only at rest or in transit, so governance has to cover the session itself.

Q: What are the best practices for reducing prompt injection risk in enterprise GenAI?

A: Test the model, retrieval layer, and connected tools together. Use adversarial prompts, sanitize inputs, constrain external content, and monitor outputs for instruction conflicts or unexpected behaviour. The objective is not perfect prevention, but reducing the chance that deceptive content can override intended system behaviour.

Q: How should security teams govern GenAI applications without breaking usability?

A: Start by mapping the request path and applying controls where risk appears, not only at login. Use role and context signals, input validation, output filtering, and audit logging together so guardrails block unsafe actions without forcing every request through the same heavy review path.

Technical breakdown

Why prompt and file pathways become the first GenAI leakage layer

GenAI tools create two leakage surfaces that legacy controls often treat separately: prompt text and uploaded files. Prompts can carry fragments of confidential context, while uploaded documents can expose entire records, plans, or source material for processing outside normal application boundaries. Traditional DLP often inspects repositories or email, but GenAI introduces a live interaction layer where data is transformed, summarized, or echoed back in ways that are harder to classify. The technical problem is not just exfiltration. It is the weakening of data handling assumptions once a user can inject sensitive content directly into an AI workflow.

Practical implication: classify prompt and upload channels as governed data paths, not informal user input.

How prompt injection bypasses safeguards in LLM configurations

Prompt injection works because the model cannot reliably separate user content from higher-priority system instructions once both are placed in the same context window. Attackers exploit that ambiguity with direct malicious prompts, embedded instructions in retrieved content, or layered phrasing designed to override safety rules. The article’s 56% bypass figure shows that many safeguards still fail under realistic testing conditions across multiple LLM configurations. This is not a single-model flaw. It is a structural control problem in how instructions, retrieval, and tool use are composed at runtime.

Practical implication: test controls against instruction-conflict scenarios, not just benign prompts.

Why AI policies fail when governance staff and incident response are missing

Policies define intent, but GenAI governance requires operational enforcement. If a company has policy language but no trained staff, no incident-response playbooks, and no monitoring workflow, then the policy cannot intervene when a risky prompt, file upload, or model output appears. That enforcement gap matters because AI risk shows up in live user behaviour, not only in annual reviews. In practice, this means governance has to be tied to evidence capture, exception handling, and response ownership. Otherwise the organisation can describe acceptable use without actually controlling it.

Practical implication: bind AI policy to named owners, evidence capture, and response paths.

Threat narrative

Attacker objective: The attacker wants to extract sensitive information or manipulate AI-driven responses in a way that increases downstream business, compliance, or fraud impact.

1. Entry occurs when employees place sensitive corporate data into prompts or uploaded files inside GenAI tools, creating an immediate exposure path through normal business use.
2. Escalation happens when prompt-injection content or malformed instructions bypass safeguards and influence outputs, decisions, or downstream actions inside the AI workflow.
3. Impact follows as sensitive information is disclosed, manipulated, or operationalized outside intended controls, expanding privacy, fraud, and compliance exposure.

Breaches seen in the wild

• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
• Samsung ChatGPT leak 2023: Samsung staff pasted chip source code and meeting notes into ChatGPT weeks after it was allowed, leading Samsung to restrict generative AI tools.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

GenAI governance lag is now a measurable control gap, not a maturity slogan. The article shows policy adoption is common while trained governance staff and incident response remain less common. That combination means organisations are writing rules faster than they can enforce them, which turns AI usage into an identity and governance problem as much as a data problem. Practitioners should read the numbers as evidence that control ownership is lagging operational adoption.

Prompt and upload channels are the new data-loss perimeter. A GenAI workflow does not merely process content, it accepts content at the moment of user intent, which changes where risk concentrates. Traditional repository controls miss this live interaction boundary, so the decisive governance question is where sensitive data is allowed to enter an AI session. The practical conclusion is that AI security must follow the transaction, not just the storage location.

Instruction hierarchy breaks down inside LLM context windows. Prompt injection succeeds because models process competing instructions in a shared runtime context, not because users always have high privilege. That makes the problem a control-composition failure, where system intent and user content collide without a reliable trust boundary. For practitioners, this means GenAI security has to treat context handling as a governed attack surface.

Ephemeral AI trust debt: organisations are accumulating exposure faster than they can prove enforcement. The article’s core message is that AI policy, data controls, and trained operators must be present together or the governance model becomes performative. Security leaders should treat GenAI oversight as an operating capability, not a document set.

AI-specific enforcement must sit alongside IAM and data governance. The article’s figures show why neither discipline is sufficient alone. IAM can govern who may use the tool, and data governance can classify the content, but only AI-aware monitoring and incident handling can address prompt-level abuse and output-driven leakage. Practitioners should expect GenAI to require cross-functional ownership, not a single control tower.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Only 23% of IT leaders were very confident in their organisation's ability to manage security and governance for GenAI deployments, according to a 2025 Gartner survey of 360 IT leaders.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

The governance pattern is now clear: organisations are adopting GenAI before they have enough staff, process, or telemetry to control its risk. That matters because AI policy can look complete on paper while enforcement is still missing at the session boundary.

Ephemeral AI trust debt: the gap between what users can do with prompts and what governance can actually prove is where most current exposure accumulates. As GenAI use spreads, that debt will show up first as oversharing, then as investigation difficulty, and then as audit friction.

Security teams should stop treating prompt safety, identity, and data governance as separate workstreams. The evidence in this article shows that GenAI risk appears at their intersection, which makes cross-functional ownership the operational baseline rather than an advanced capability.

For practitioners

• Define AI-specific data handling rules Classify prompts, uploads, and outputs as governed data paths with explicit sensitivity handling, retention, and review obligations.
• Test prompt-injection resistance Run adversarial tests across the exact LLM configurations, retrieval layers, and tool integrations your teams actually use.
• Bind policy to named governance owners Assign accountable owners for exceptions, evidence capture, and incident response so AI policy can be enforced during live use.
• Add real-time monitoring for risky AI activity Detect unusual prompt patterns, suspicious uploads, and output paths that indicate oversharing or manipulation before the session closes.

Key takeaways

• GenAI risk is no longer hypothetical. The article shows that sensitive data routinely enters prompts and uploads, while prompt injection still bypasses safeguards in many configurations.
• The scale of the governance gap is visible in the numbers. Most organisations have AI policies, but far fewer have trained staff or incident-response capability to enforce them.
• The practical lesson is to govern GenAI where it is used, not just where it is stored. Controls need to follow prompts, files, and outputs into the live session.

Key terms

• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• AI-specific Data Loss Prevention: AI-specific Data Loss Prevention is the set of controls that stop sensitive data from being exposed, copied, or misused by AI systems. It monitors prompts, outputs, training data, retrieval sources, and agent actions, then applies policy, redaction, blocking, or alerting to prevent leakage of regulated, confidential, or proprietary information.
• Governance-to-Enforcement Gap: The governance-to-enforcement gap is the distance between a written control and the point where that control actually affects system behaviour. In AI programmes, it appears when policies exist but agents can still act outside them because no runtime mechanism stops the action.
• AML Transaction Monitoring: AML transaction monitoring is the ongoing review of payment and account activity to identify patterns that may indicate money laundering or related financial crime. It combines rules, thresholds, typologies, and analyst review to turn raw transaction data into defensible compliance decisions.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.