Notifications
Clear all
Topic starter
10/06/2026 12:00 am
TL;DR: Enterprises are projected to spend $124 million on AI in 2026 while only 21% report mature governance for agentic AI, and 63% now require human validation of agent outputs, according to Cranium’s analysis of KPMG and Deloitte data. The trust gap is no longer theoretical: it is the main constraint on safe AI scale.
NHIMG editorial — based on content published by Cranium: the 2026 trust paradox and the path to operationalised AI trust
By the numbers:
- Business leaders are projected to deploy $124 million on average toward AI in 2026, with 91% of leaders stating that data security and risk will dictate their strategy over the next six months.
- Deployment of AI agents has tripled in the last 18 months, with 54% of organizations now actively deploying agents to automate cross-functional workflows.
- Despite this surge, only 21% of companies report having a mature governance model for agentic AI.
Questions worth separating out
Q: How should security teams govern AI agents that cross business workflows?
A: Security teams should treat cross-functional AI agents as governed identities with explicit access boundaries, owners, and review points.
Q: Why do AI governance programmes stall at the pilot stage?
A: They stall because pilot controls are usually advisory, while production requires provable trust across access, monitoring, and accountability.
Q: What do teams get wrong about human validation of AI outputs?
A: Teams often treat human validation as a blanket safeguard, when it should be a targeted control for higher-risk decisions.
Practitioner guidance
- Define approval boundaries for AI agent actions Separate actions that require pre-approval, actions that need post-execution review, and actions that remain fully delegated.
- Create a system of record for AI supply chains Track each production model, third-party vendor, dataset, and tool dependency with an accountable owner.
- Instrument continuous monitoring for agent drift Measure whether an agent stays within its intended parameters after deployment, including access scope, output changes, and unusual tool use.
What's in the full article
Cranium's full blog post covers the operational detail this post intentionally leaves for the source:
- The article's four-part operating model for unified AI visibility across models, datasets, vendors, and workflows.
- The specific role of adversarial stress-testing in an AI SecDevOps cycle before production deployment.
- How the AI Card maps security and compliance evidence to frameworks such as the EU AI Act and NIST AI RMF.
- The vendor's view of continuous monitoring and immediate remediation for agentic systems that drift.
👉 Read Cranium's analysis of the AI trust gap and governance maturity →
AI governance maturity gap: what IAM and security teams need now?
Explore further
10/06/2026 2:35 am
Operational trust is the real prerequisite for enterprise AI scale. The article’s central message is not that organisations lack ambition, but that they lack a provable trust model spanning models, agents, and governance workflows. That makes AI scaling an identity and control problem before it is a deployment problem. Practitioners should read this as a signal that governance evidence must be built into the operating model, not appended after rollout.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: How can organisations tell whether AI governance is actually working?
A: Look for evidence that every model and agent has an owner, every dependency is recorded, and every high-risk action has a defined approval or containment path. If the organisation can only describe policy in general terms, governance is aspirational. Real control shows up in traceability, monitoring, and documented remediation.
👉 Read our full editorial: AI governance maturity lags behind enterprise scaling plans
