Topic starter
02/08/2026 11:47 am
TL;DR: 90% of enterprises are already running Enterprise GenAI at scale, but only 34% of CISOs feel reasonably confident in their AI data security controls and just 1 in 5 initiatives are meeting intended KPIs, according to Mind and CISO ExecNet. The gap shows that governance without enforcement does not survive AI-driven access to unclassified and overshared data.
Editorial analysis by NHI Mgmt Group, based on content published by Mind: “Data trust is the hidden reason most AI initiatives fail”.
By the numbers:
- Only 34% of CISOs describe themselves as reasonably confident in their AI data security controls, according to MIND research.
- Only 1 in 5 AI initiatives are meeting their intended KPIs, according to MIND research.
Key questions
Q: What breaks when enterprise GenAI connects to poorly governed data sources?
A: Human-centric governance breaks because AI does not rely on judgement or delay.
Q: Why do AI initiatives expose gaps in data security governance?
A: AI compresses storage, retrieval, and use into one workflow, so any data blind spot becomes easier to amplify and harder to contain.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Practitioner guidance
- Instrument data reachability before expanding AI access Map which repositories, file stores and collaboration spaces AI tools can actually query, then compare that reach against what the business believes is sensitive.
- Bind AI permissions to named ownership and revocation Treat AI agents and copilots as non-human identities with owners, scopes and offboarding requirements.
- Enforce classification at the point of access Do not rely on labels alone.
Bottom line: Enterprise GenAI exposes long-standing data governance weakness because models can reach unclassified and overshared content instantly once connected.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:57 pm
Data trust is now a control outcome, not a policy outcome. Organisations that rely on written governance without runtime enforcement are discovering that AI makes dormant access mistakes visible immediately. That changes the security question from 'Do we have a policy?' to 'Can we stop AI from acting on data that policy never truly governed?' Practitioners should treat enforceable data trust as a measurable security state.
A few things that frame the scale:
- Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring. The control set should include inventory, task-bound credentials, audit trails, and revocation paths. If an agent can call tools or touch production systems, it belongs in the same governance model as service accounts and other machine identities.
👉 Read our full editorial: Data trust is the limiting factor in enterprise GenAI security