Notifications
Clear all
Topic starter
21/08/2026 4:59 pm
TL;DR: AI governance fails when teams protect only approved tools and miss unmanaged notebooks, pipelines, models, containers, and endpoints across cloud and on prem, according to AccuKnox. The article argues that governance must span discovery, testing, runtime guardrails, and evidence generation because partial coverage leaves architectural blind spots.
NHIMG editorial — based on content published by AccuKnox: AI Governance Needs Full Coverage Atharva Shah | Edited : August 12, 2026
By the numbers:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
- Systems with least-privileged AI access had a 17% incident rate versus 76% for over-privileged systems.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
Questions worth separating out
Q: How should security teams govern AI in the security stack?
A: Security teams should treat AI as a governed decision aid, not an autonomous authority.
Q: Why do AI governance programs fail when they rely on approved-tool lists alone?
A: Approved-tool lists only describe which applications were reviewed, not what AI can reach after deployment.
Q: What do enterprises get wrong about AI red teaming maturity?
A: Many teams stop at attack simulation and assume the test itself is the control.
Practitioner guidance
- Map the full AI estate before writing policy Inventory cloud-managed, cloud-unmanaged, on-prem-managed, and on-prem-unmanaged AI assets, then tie each asset to an owner, data boundary, and lifecycle state.
- Adopt continuous testing for every material model change Retest prompts, models, and agent behaviors whenever a deployment, fine-tune, or prompt template changes.
- Enforce runtime controls where AI can act Place stateful guardrails at gateways, SDK hooks, browser surfaces, and platform integrations so the same policy follows the session across tools and downstream actions.
What's in the full article
AccuKnox's full article covers the operational detail this post intentionally leaves for the source:
- The full breakdown of the four-pillar governance model across discover, test, guard, and surface.
- The product-specific view of how AI-SPM maps inventory into ownership scoring and drift detection.
- The runtime enforcement detail behind stateful prompt firewalling and shadow AI mitigation.
- The architecture choices behind agentic AI security, including workload identity and fine-grained authorization.
👉 Read AccuKnox's analysis of full-coverage AI governance across cloud and on prem →
AI governance across managed and shadow estates: where are the gaps?
Explore further
21/08/2026 5:15 pm
AI governance is really an estate coverage problem, not a policy problem. The article is right to separate discovery, testing, guardrails, and surfacing because no single control can govern AI that exists in multiple operating modes. Managed services, unmanaged notebooks, on prem models, and shadow endpoints create different control surfaces, but the governance objective is the same: prove what exists and who owns it. Practitioners should stop treating AI governance as a document review exercise and start treating it as an inventory and enforcement discipline.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the same survey.
A question worth separating out:
Q: How do teams know whether AI governance is actually working?
A: Look for evidence that every AI interaction can be traced end to end, from identity and intent to output and enforcement. If auditors can ask for a transaction and receive a complete record in hours, not weeks, the programme is producing usable control evidence rather than just documentation.
👉 Read our full editorial: AI governance needs full coverage across cloud and on prem
