Topic starter
05/07/2026 6:44 pm
TL;DR: AI systems now operate across employees, applications, and agents, which fragments risk and makes point solutions ineffective, according to Lakera. A unified control plane is becoming the practical model for runtime visibility, policy enforcement, and governance across the full execution lifecycle.
Editorial analysis by NHI Mgmt Group, based on content published by Lakera: “AI Security Isn’t One Problem Anymore. So Why Are We Still Treating It Like One?”.
Key questions
Q: How should security teams govern AI in the security stack?
A: Security teams should treat AI as a governed decision aid, not an autonomous authority.
Q: Why do point solutions fail for AI security?
A: Point solutions fail because AI risk is distributed across human use, application behaviour and agent actions.
Q: What are the signs that AI governance is too fragmented to support scale?
A: Common signs include duplicated governance tools, inconsistent policies across business units, and teams managing AI or data controls in isolation.
Practitioner guidance
- Map the AI execution lifecycle Identify where AI begins in employee workflows, where applications assemble prompts and context, and where agents can take action.
- Enforce runtime policy for AI actions Apply rules at the moment an AI system retrieves data, calls tools or triggers an external action.
- Correlate telemetry across AI surfaces Tie together employee usage, application events and agent activity so that one workflow can be traced end-to-end.
Bottom line: AI security is fragmenting across users, applications and agents, which makes isolated controls incomplete by design.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
05/07/2026 7:01 pm
AI security has become a control-plane problem, not a point-control problem. Once AI reaches across employees, applications and agents, the unit of governance stops being the single tool or model and becomes the execution path. That changes how practitioners think about visibility, enforcement and accountability, because risk now travels across systems rather than living inside one of them. The implication is that AI security programmes need to be designed around coordination, not isolated inspection.
A few things that frame the scale:
- Only 23% of IT leaders were very confident in their organisation's ability to manage security and governance for GenAI deployments, according to a 2025 Gartner survey of 360 IT leaders.
A question worth separating out:
Q: What happens when AI agents are allowed to act on behalf of users without tight consent controls?
A: When AI agents can access sensitive APIs without tight guardrails, a prompt mistake, hallucination, or hijacked instruction can turn delegated access into unauthorized action. The risk is not only data exposure. It also includes actions taken with valid credentials that users did not intend, which makes review, containment, and attribution much harder after the fact.
👉 Read our full editorial: AI security needs a control plane across employees, apps and agents