Topic starter
05/07/2026 6:51 pm
TL;DR: Nearly half of organisations are already deploying GenAI in production, yet only 19% feel highly confident in their security posture and 49% remain highly concerned about vulnerabilities, according to Lakera’s 2025 GenAI Security Readiness Report. The readiness gap is now operational, not theoretical, and it is widening as runtime attacks, integration complexity, and skill shortages outpace existing governance models.
Editorial analysis by NHI Mgmt Group, based on content published by Lakera: “2025 GenAI Security Readiness Report: A Clearer Picture of Where Enterprises Stand”.
Key questions
Q: What breaks when GenAI is deployed without formal audit controls?
A: Without formal audit controls, organisations lose visibility into prompt behavior, context retrieval, policy enforcement, and output traceability.
Q: Why do GenAI incidents not automatically improve security readiness?
A: Incidents often raise awareness, but awareness does not create repeatable control design.
Q: How should teams prioritise GenAI security investments when skills are limited?
A: Teams should prioritise governance and integration controls before expanding use cases.
Practitioner guidance
- Define GenAI workflow trust boundaries Inventory every model, connector, and downstream action path so teams know which data sources and tools each GenAI workflow can reach.
- Separate prompt, data, and action controls Use distinct controls for what the model can read, what it can reference, and what it can trigger so a single failure does not cascade across the workflow.
- Track incident classes as governance signals Classify prompt injection, insecure integrations, and manipulated outputs as repeatable governance failures rather than isolated incidents.
Bottom line: GenAI adoption is now widespread enough that governance gaps are no longer hypothetical, and the report shows readiness has not kept pace with deployment.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
05/07/2026 7:11 pm
Readiness is now a runtime governance problem, not a model-adoption problem. Once GenAI is embedded in live workflows, the meaningful question shifts from whether the organisation is using AI to whether it can govern what the system can access and do in real time. That distinction matters because workflow integration expands the control surface beyond the model itself. Practitioners should treat GenAI security as part of operational identity and access governance, not a separate innovation track.
A few things that frame the scale:
- Generative AI use specifically increased from 33% in 2023 to 79% in 2025, according to McKinsey’s Global Surveys on the State of AI.
A question worth separating out:
Q: What does it mean when confidence is high but readiness is low in GenAI security?
A: It means the organisation believes its position is stronger than its operating controls actually are. In GenAI programmes, confidence can reflect policy intent or executive optimism, while readiness depends on whether teams can block unsafe prompts, contain integrations, and monitor runtime behaviour consistently.
👉 Read our full editorial: GenAI security readiness lags adoption across enterprise workflows