Topic starter
05/07/2026 6:55 pm
TL;DR: AI adoption is broadening faster than security readiness, with 49% of firms using tools like ChatGPT across departments and 77% of organisations reporting they are unprepared to defend against AI threats, according to Lakera and cited industry research. The security problem is no longer awareness, but governance that can keep pace with how AI is actually being used.
Editorial analysis by NHI Mgmt Group, based on content published by Lakera: “AI Security Trends 2025: Market Overview & Statistics”.
By the numbers:
- 49% of firms use tools like ChatGPT across departments, from IT and marketing to finance and customer service.
- 77% of organisations find themselves unprepared to defend against AI threats.
- 90% of organisations are actively implementing or planning to explore LLM use cases.
Key questions
Q: How should security teams enforce AI acceptable use policies at runtime?
A: Security teams should pair the written policy with discovery, intent-based controls, and audit logging.
Q: Why do AI tools create governance risk even when humans stay in charge?
A: AI tools create risk when they reshape the real decision path without changing formal ownership.
Q: What are the signs that AI is not being governed well in a security program?
A: Warning signs include unclear ownership, no formal review of AI use cases, weak vendor due diligence, and limited ability to explain how decisions are made or tested.
Practitioner guidance
- Define AI usage boundaries by data class Classify which data types may enter public, enterprise, and embedded AI tools, then enforce the policy through DLP, application controls, and user guidance.
- Inventory AI-connected access paths Map every internal app, browser extension, workflow, or service account that can submit prompts or consume model output, including sanctioned and unsanctioned paths.
- Separate human and non-human AI use cases Document where people interact directly with AI and where services, automations, or integrations do so on their behalf, because the control model differs.
Bottom line: AI adoption is now broad enough that security teams can no longer treat it as a niche innovation concern.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
05/07/2026 7:17 pm
AI security governance is now an access problem, not just a model-risk problem: once tools like ChatGPT are used across departments, the real control question becomes who can use them, what data they can reach, and what actions outputs can trigger. That crosses IAM, data governance, and application policy boundaries. Treating AI as a standalone innovation silo leaves the access model incomplete, so practitioners need governance that follows usage rather than vendor rollout.
A few things that frame the scale:
- Only 23% of IT leaders were very confident in their organisation's ability to manage security and governance for GenAI deployments, according to a 2025 Gartner survey of 360 IT leaders.
A question worth separating out:
Q: What should organisations do when AI regulation and adoption move at different speeds?
A: They should build internal controls that can absorb regulatory change without rebuilding the entire programme each time. That means clear accountability, documented use cases, and policy enforcement that can adapt as legal requirements evolve across privacy, security, and sector-specific obligations.
👉 Read our full editorial: AI security trends show adoption outpacing governance controls