Topic starter
15/08/2026 6:12 pm
TL;DR: AI security and governance remain split in many enterprises, creating blind spots that let threats slip past compliance processes and leave security teams without policy context, according to Obsidian Security. The gap is now a governance problem as much as a technical one, because integrated controls determine whether AI can be deployed with accountability.
Editorial analysis by NHI Mgmt Group, based on content published by Obsidian Security: “Bridging the Gap Between AI Security and Governance”.
By the numbers:
- 73% of organisations experienced at least one AI-related security incident in 2024, with many stemming from governance failures rather than technical vulnerabilities.
- Organisations with integrated approaches reported 45% fewer compliance violations and 60% faster incident resolution times.
- Regulatory fines for AI governance failures reached $2.3 billion globally in 2024.
Key questions
Q: How do security teams align AI governance with existing IAM and data security programmes?
A: Security teams should align AI governance with existing IAM and data security programmes by mapping every AI workflow to an accountable identity, a sensitive-data classification, and a logging requirement.
Q: Why do separate security, privacy, and AI risk programs create governance blind spots?
A: Separate programs often collect the same evidence in different formats, follow different review cycles, and leave gaps between teams that own adjacent risks.
Q: What are the signs that AI governance controls are not keeping pace with adoption?
A: Common warning signs include unclear ownership for AI use cases, inconsistent approval processes, limited visibility into where sensitive data enters models, and weak evidence for audits or assessments.
Practitioner guidance
- Build a unified AI control inventory Track every AI system, integration, token, and delegated permission in one inventory so security and governance teams are reviewing the same estate.
- Map controls to a formal AI management system Tie AI risk decisions to NIST AI RMF and ISO 42001 so approvals, monitoring, and evidence are captured in one operating model.
- Constrain identity and token scope for AI workloads Review SaaS permissions, app-to-app access, and service tokens for AI systems with the same discipline used for high-risk NHI credentials.
Bottom line: The article frames AI security and governance as one operational problem, because separating them creates blind spots in approvals, monitoring, and accountability.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
15/08/2026 6:19 pm
AI governance debt is now a security problem, not just a compliance problem. When AI security and governance are separated, organisations accumulate control debt across approvals, monitoring, and evidence. That debt shows up when teams cannot explain who authorised access, which policy governed it, or whether the system still matches the original risk decision. The practical conclusion is that AI programmes need joined-up control ownership before scale makes the gap permanent.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should organisations do after an AI security incident?
A: Contain the affected identities and integrations first, then review every connected agent, connector, and fallback path for the same failure pattern. Reset secrets, rotate credentials, validate logs, and test whether the issue can recur through another input channel. The goal is to stop one flaw from becoming a repeatable platform weakness.
👉 Read our full editorial: AI security and governance gaps are widening across enterprise AI