Topic starter
09/07/2026 12:35 pm
TL;DR: GenAI adoption is accelerating faster than governance, with 4% of prompts and over 20% of file uploads containing sensitive corporate data, 56% of prompt-injection tests bypassing safeguards, and 75% of companies reporting AI policies while fewer than 60% have trained governance staff, according to Knostic. The evidence shows that policy alone does not enforce identity, data, or incident controls.
Editorial analysis by NHI Mgmt Group, based on content published by Knostic: “The 10 Biggest Statistics and Trends for GenAI Security”.
By the numbers:
- 4% of prompts to GenAI tools contain sensitive corporate data, according to Knostic.
- Over 20% of files uploaded to GenAI tools contain sensitive corporate data, according to Knostic.
- 75% of companies have AI policies, but fewer than 60% have trained governance staff or incident-response capabilities, according to Knostic.
Key questions
Q: What breaks when GenAI policies exist but trained governance staff do not?
A: Policies without trained staff usually fail at the point of enforcement.
Q: Why do prompts and file uploads create more AI data risk than traditional repositories?
A: Because they place sensitive content directly into a live AI workflow where it can be processed, summarized, or echoed back outside the normal storage controls.
Q: What are the best practices for reducing prompt injection risk in enterprise GenAI?
A: Test the model, retrieval layer, and connected tools together.
Practitioner guidance
- Define AI-specific data handling rules Classify prompts, uploads, and outputs as governed data paths with explicit sensitivity handling, retention, and review obligations.
- Test prompt-injection resistance Run adversarial tests across the exact LLM configurations, retrieval layers, and tool integrations your teams actually use.
- Bind policy to named governance owners Assign accountable owners for exceptions, evidence capture, and incident response so AI policy can be enforced during live use.
Bottom line: GenAI risk is no longer hypothetical. The article shows that sensitive data routinely enters prompts and uploads, while prompt injection still bypasses safeguards in many configurations.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 12:40 pm
GenAI governance lag is now a measurable control gap, not a maturity slogan. The article shows policy adoption is common while trained governance staff and incident response remain less common. That combination means organisations are writing rules faster than they can enforce them, which turns AI usage into an identity and governance problem as much as a data problem. Practitioners should read the numbers as evidence that control ownership is lagging operational adoption.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
- Only 23% of IT leaders were very confident in their organisation's ability to manage security and governance for GenAI deployments, according to a 2025 Gartner survey of 360 IT leaders.
A question worth separating out:
Q: How should security teams govern GenAI applications without breaking usability?
A: Start by mapping the request path and applying controls where risk appears, not only at login. Use role and context signals, input validation, output filtering, and audit logging together so guardrails block unsafe actions without forcing every request through the same heavy review path.
👉 Read our full editorial: GenAI security statistics show governance is lagging adoption