Topic starter
06/09/2026 5:18 pm
TL;DR: IBM and the Ponemon Institute’s 2025 Cost of a Data Breach report, cited by Vorlon, shows that 97% of organisations with an AI-related security incident lacked proper AI access controls, while 63% still had no formal AI governance framework, underscoring how quickly AI adoption is outrunning identity oversight. The governance gap is now an access-control problem, not a future policy exercise.
Editorial analysis by NHI Mgmt Group, based on content published by Vorlon: “IBM's 2025 breach report: How bad is the AI governance gap?”.
By the numbers:
- 97% of organizations that experienced an AI-related security incident lacked proper AI access controls.
- 63% of breached organizations either don't have AI governance policies or are still developing them.
Key questions
Q: What breaks when GenAI tools are embedded in SaaS without IAM oversight?
A: The control that breaks is identity governance over the integration itself.
Q: Why does weak AI governance increase breach risk when AI expands identity access?
A: Because AI often inherits existing permissions instead of creating new ones, so any oversharing is instantly amplified.
Q: What are the warning signs that shadow AI is becoming a security problem?
A: Look for AI tools connected outside approved procurement, unexplained API or token usage, and data leaving normal SaaS boundaries.
Practitioner guidance
- Define the AI identity perimeter Inventory every AI tool, copilot, service account, token, and API path that can reach business data, then assign ownership for each connection.
- Tighten permissions for AI-connected identities Reduce inherited access on AI-linked accounts to the minimum scope required for the workflow, and remove broad SaaS entitlements that are not essential.
- Automate shadow AI discovery Continuously scan SaaS and application integrations for unsanctioned AI connections, then revoke risky tokens or permissions before they spread across systems.
Bottom line: IBM’s breach data shows that AI risk is concentrated at the point where access, governance, and visibility fail to meet in production.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 5:19 pm
AI governance has become an identity governance problem. The IBM findings show that the failure point is not abstract policy intent but the access path itself. If AI tools can connect to SaaS, APIs, and data stores without enforced identity boundaries, governance never reaches the control plane that matters. The practical conclusion is that AI governance and IAM can no longer be managed as separate programmes.
A few things that frame the scale:
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations treat AI access reviews differently from standard IAM reviews?
A: Yes. Standard reviews are usually centred on users and applications, while AI access reviews must also examine the connected identity, the data it can traverse, and the downstream SaaS integrations. Otherwise the review approves a label, not the actual control surface.
👉 Read our full editorial: IBM breach findings expose the AI governance gap in enterprise IAM