Topic starter
06/09/2026 5:18 pm
TL;DR: AI adoption is already moving into production, but security and compliance are now the main reasons programmes stall, with 37% of enterprises citing them as the top blocker and AI-related breaches costing 4.8 million USD on average, according to LEVO. The central issue is that AI risk now lives inside runtime behaviour, so governance needs agent identity, continuous visibility, and enforced access controls rather than perimeter-only review.
Editorial analysis by NHI Mgmt Group, based on content published by LEVO: “Common AI Security Concerns”.
By the numbers:
- 37% of enterprises cite security and compliance as the number one reason AI initiatives slow down or fail to reach production.
Key questions
Q: What breaks when AI agents are given broad enterprise access without tight governance?
A: Broad access turns AI agents into high-speed execution paths that can move data, spend money, modify records, or delete assets before operators can intervene.
Q: Why do AI security gaps slow production adoption and not just increase risk?
A: Because leaders cannot approve what they cannot control.
Q: How do teams know whether AI runtime enforcement is actually working?
A: Look for low-latency enforcement, consistent decisions across languages and encodings, complete telemetry, and repeatable blocking of risky content under load.
Practitioner guidance
- Define a first-class identity for every AI agent Bind each agent to an owner, a scope, and a revocation path so actions remain attributable across production workflows.
- Limit delegated access before agents go live Grant only the data, tools, and API permissions the task requires, then review those permissions as the workflow changes.
- Instrument runtime visibility for prompt and tool activity Log prompt inputs, tool calls, data access, and policy decisions so security teams can detect misuse while execution is still in flight.
Bottom line: AI adoption is being constrained less by model capability than by the lack of runtime security, attribution, and governance for AI agents.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 5:19 pm
AI security is now an identity governance problem, not just a model risk problem. The article shows that the control failure is happening inside runtime execution, where agents act with delegated authority and make decisions after deployment. That means access scope, attribution, and revocation matter as much as prompt safety or model testing. Practitioners should treat AI systems as identity-bearing workloads that need lifecycle governance, not as tools that can be secured only at the perimeter.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations govern AI agents differently from chatbots?
A: Yes. Chatbots mainly expose content risk, while AI agents create action risk because they can decide, select tools, and execute in live systems. Governance has to focus on delegated authority, business-process containment, and runtime boundaries rather than conversation safety alone.
👉 Read our full editorial: AI security gaps are slowing adoption and raising breach costs