Topic starter
07/06/2026 9:22 pm
TL;DR: AI use is now mainstream in enterprises, but only 13% of organisations report strong visibility into how it touches data, while 66% have already caught AI over-accessing sensitive information, according to Cyera’s 2025 State of AI Data Security Report. The real problem is not adoption, it is that governance still treats AI like an ordinary app or user and therefore misses prompt-layer risk and over-permissioned access.
Editorial analysis by NHI Mgmt Group, based on content published by Cyera: “83% Use AI; Only 13% Have Visibility - Cyera’s 2025 State of AI Data Security Report”.
By the numbers:
- 83% of enterprises already use AI in daily work, according to Cyera research.
- Only 13% report strong visibility into how AI touches enterprise data, according to Cyera research.
- Only 11% can automatically block risky AI activity, according to Cyera research.
Key questions
Q: What breaks when AI agents are treated like standard human users?
A: You lose visibility into effective permissions, expected behaviour, and real blast radius.
Q: Why do AI agents create a bigger governance problem than ordinary endpoint tools?
A: Because an AI agent can execute many file reads, API calls, and transfers in one session without a human approving each step.
Q: How can organisations tell whether their AI security model is actually working?
A: They should test whether the control stack can explain who acted, what data was touched, and what purpose the action served.
Practitioner guidance
- Instrument AI activity at the prompt layer Capture prompts, outputs, access decisions, and anomaly signals early enough to support containment rather than only post-incident review.
- Assign AI a first-class identity model Treat AI systems as governed identities with named owners, scoped permissions, and explicit lifecycle control rather than as informal extensions of user access.
- Constrain autonomous agent scopes Limit the data and tool reach of autonomous agents to the smallest task-specific boundary, and require approval gates for higher-risk actions.
Bottom line: AI use is already widespread, but governance still trails the way AI touches data in practice.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 hours ago by NHI Mgmt Group
08/06/2026 9:17 am
AI governance is becoming an identity problem before it becomes a data problem. Cyera’s survey shows that enterprises are already using AI at scale while only a small minority can see how it touches data in real time. That means the first failure is not exfiltration, but the absence of a governable identity boundary around AI activity. Practitioners should treat AI access as a first-class entitlement model, not a side effect of application rollout.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations use the same access model for humans and AI agents?
A: No. Human access models are built around stable roles and review cycles, while AI agents often need contextual, task-specific permissions that change quickly. Treating them the same usually leads to over-permissioning or constant exceptions. Organisations should separate identity proof from authorization design and apply resource-level controls for agents.
👉 Read our full editorial: AI data security controls are lagging behind enterprise AI use
This post was modified 4 hours ago by NHI Mgmt Group