Notifications
Clear all
Topic starter
02/08/2026 11:47 am
TL;DR: 90% of enterprises are already running Enterprise GenAI at scale, but only 34% of CISOs feel reasonably confident in their AI data security controls and just 1 in 5 initiatives are meeting intended KPIs, according to Mind and CISO ExecNet. The gap shows that governance without enforcement does not survive AI-driven access to unclassified and overshared data.
NHIMG editorial — based on content published by Mind: Data trust is the hidden reason most AI initiatives fail
By the numbers:
- 90% of enterprises are already running Enterprise GenAI at scale.
- only 34% of CISOs describe themselves as reasonably confident in their AI data security controls.
- only 1 in 5 of those AI initiatives are meeting their intended KPIs.
Questions worth separating out
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring.
Q: Why do enterprise GenAI tools expose hidden data governance problems?
A: Because they query at scale and immediately surface whatever the organisation already left reachable.
Q: What breaks when AI security relies only on policy and review?
A: Policy-only programmes break because they describe expected behaviour without constraining live execution.
Practitioner guidance
- Inventory AI-connected data paths Map every repository, connector, and retrieval path used by enterprise GenAI tools before expanding usage.
- Re-scope AI agent permissions Assign machine identities the minimum permissions needed for each workflow, and separate read, write, and administrative access.
- Enforce classification at the data layer Apply data classification and access mediation to the repositories AI can reach, so sensitive files are filtered or blocked before retrieval.
What's in the full report
Mind's full report covers the operational detail this post intentionally leaves for the source:
- The survey methodology behind the 124 CISO responses and 20 qualitative interviews
- The seven research insights that connect data trust, AI adoption, and governance failure
- Practical guidance on building a minimum viable security foundation for enterprise AI
- The article's internal case examples showing how overshared repositories become exposed through GenAI
👉 Read Mind's report on data trust and enterprise GenAI security →
Enterprise GenAI at scale: why data trust is failing security teams?
Explore further
02/08/2026 12:57 pm
Data trust is now the control plane for enterprise AI. Boards can approve AI programmes and security teams can write policy, but neither outcome matters if the organisation cannot prove what data is classified, who can reach it, and whether that access is enforced in runtime. In practice, AI turns latent governance debt into visible risk. Practitioners should treat data trust as a measurable security condition, not a business slogan.
A question worth separating out:
Q: How do organisations know whether AI data trust is actually improving?
A: Look for fewer overshared repositories, clearer classification coverage, narrower agent permissions, and logs that show real-time enforcement rather than post-hoc review. If AI initiatives keep finding sensitive material that should have been hidden, then the governance model is still below the threshold needed for safe scale.
👉 Read our full editorial: Data trust is the limiting factor in enterprise GenAI security
