ChatGPT 
Summary
Key takeaways
- Enterprise AI security is broader than model safety: it must protect people, data, models, identities, tools, agents, and the business actions AI systems can trigger.
- AI-enabled attacks are already a mainstream enterprise risk, while shadow AI and unmanaged employee use remain some of the biggest sources of exposure.
- The model should never be treated as a policy engine; authorization decisions must happen outside the model through deterministic code and verified identity.
- AI agents require their own identities, short-lived credentials, least-privilege access, per-tool authorization, and rapid revocation just like other privileged workloads.
- All model traffic should pass through a controlled AI gateway that enforces approved providers, quotas, logging, trace IDs, and data-loss-prevention policies.
- Permission-aware retrieval is critical for enterprise RAG because users should never receive information they could not access directly in the source system.
- Every tool call from an agent should be treated as a privileged action and validated against strict schemas before execution.
- Prompt injection cannot be solved reliably inside the model alone, so the practical defense is to limit what a manipulated model is capable of doing.
- High-impact AI systems need red teaming, release gates, observability, audit trails, incident-response procedures, tested kill switches, and rollback capability.
- The highest-priority actions for most enterprises are to inventory AI systems, approve tools, define data rules, assign agent identities, and test emergency containment.
When this applies
This applies when an organization uses enterprise AI tools, custom AI applications, RAG systems, AI agents, MCP servers, AI-generated code, or AI features connected to internal business systems. It is especially relevant for CIOs, CTOs, CISOs, risk leaders, data leaders, and business owners who need to move AI from experimentation into governed production use. The guidance is particularly important when AI can access confidential data, call tools, modify records, communicate externally, execute code, approve transactions, or operate with delegated permissions.
When this does not apply
This does not replace a full cybersecurity program, formal penetration testing, legal advice, regulatory interpretation, or organization-specific threat modeling. Very small experiments using public data and no privileged integrations may not require the complete control stack described here, although basic tool approval, data rules, and identity controls still remain useful. It is also not a model-selection guide: the focus is on securing the enterprise system around AI rather than comparing foundation models or vendors by capability.
Checklist
- Create a complete inventory of models, agents, prompts, datasets, vector stores, MCP servers, tools, and AI vendors.
- Assign a named business owner, risk owner, and technical custodian to every AI system.
- Publish an approved AI tool list and define which providers and models employees may use.
- Define what data may and may not enter AI systems, including rules for source code, regulated data, secrets, and credentials.
- Require SSO and MFA for approved enterprise AI tools.
- Give every production agent its own identity instead of reusing human sessions or shared API keys.
- Use short-lived, task-scoped credentials and least-privilege permissions for agent access.
- Route model traffic through a central gateway that enforces policy, quotas, logging, and DLP controls.
- Apply document-, row-, and tenant-level permissions before data enters retrieval or model context.
- Authorize every tool call outside the model and validate parameters against strict schemas.
- Require human approval for payments, legal commitments, external messages, deletions, deployments, and privilege changes.
- Run generated code only inside sandboxes with deny-by-default network access.
- Threat-model high-impact systems against OWASP LLM and agentic AI risks and MITRE ATLAS.
- Log prompts, retrieved context, tool calls, approvals, outcomes, model versions, and security events sufficiently for incident reconstruction.
- Test kill switches, credential revocation, rollback, circuit breakers, and incident-response procedures at least quarterly.
Common pitfalls
- Treating the LLM itself as the security or authorization layer.
- Allowing employees to use unapproved consumer AI accounts with corporate data.
- Blocking AI tools without providing usable approved alternatives, which pushes employees toward shadow AI.
- Giving agents shared API keys or inherited human credentials instead of independent identities.
- Checking permissions after retrieval instead of preventing unauthorized data from entering the model context.
- Allowing agents broad tool access when they only need a small set of task-specific permissions.
- Relying only on prompt filtering to defend against prompt injection.
- Running AI-generated code with unrestricted filesystem, credential, or network access.
- Deploying agents without spend limits, step limits, timeouts, circuit breakers, or a tested kill switch.
- Logging too little to reconstruct incidents or logging so much sensitive content that the audit system becomes another data-exposure risk.
AI now writes code, answers customers, approves refunds and calls other software. In 2026, AI also became a primary attack path. One in four malicious breaches was AI-enabled, and those breaches cost an average of $6 million (IBM, 2026). This guide tells CEOs, CFOs, CIOs, CISOs and VPs what to decide, what to fund and what to measure, so that AI scales without uncontrolled risk.
Uvik Software built this guide from 2026 breach, threat and regulatory data, and from the controls that our senior Python and AI engineers use when they ship agents, retrieval systems and model integrations into production. It contains 38 sourced statistics, five original Uvik Software frameworks, a 90-day plan and a free workbook with 60 controls.
Key takeaways
- AI-enabled attacks are now mainstream. One in four malicious breaches was AI-enabled in 2026, at an average cost of $6 million (IBM).
- Ungoverned use causes most of the damage. Breached organizations that reported a shadow AI incident rose from 20% to 43%, and these breaches cost $5.39 million on average (IBM).
- Agents change the risk model. 88% of organizations reported confirmed or suspected AI agent security incidents, but only 21.9% treat agents as identity-bearing entities (Gravitee).
- The model is not a policy engine. Authorize every AI action outside the model, with a verified identity and deterministic code.
- Regulation now has firm dates. EU AI Act high-risk obligations apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems (European Commission).
- Five moves in 30 days address the largest exposures: an AI inventory, approved tools, data rules, agent identity and a tested kill switch.
What is enterprise AI security?
Enterprise AI security is the discipline that protects an organization’s use of AI, from employee chat tools to autonomous agents, across people, data, models, identities, tools and business actions. Uvik Software defines it as one control system with three goals: keep sensitive data inside approved boundaries, keep every AI action inside authorized limits, and detect and contain failures fast. It is broader than model safety, and it is broader than prompt filtering.
The scope covers employee use of public and enterprise AI tools, custom AI applications, retrieval-augmented generation (RAG) systems, AI agents, Model Context Protocol (MCP) servers, AI-generated code and AI features inside SaaS products. NIST’s draft Cyber AI Profile organizes the field into three focus areas: secure AI system components, use AI for cyber defense, and thwart AI-enabled attacks. This guide focuses on the first area, because that is where most organizations have the largest control gap.
Why AI security is a board issue in 2026
IBM’s Cost of a Data Breach Report 2026 studied 602 breached organizations. The global average breach cost reached a record $4.99 million, up 12% in one year, and the United States average reached $11.5 million. AI-enabled breaches, mostly deepfake impersonation and AI-enabled malware, averaged $6 million (IBM Newsroom).
Attacks on AI systems are no longer rare. More than 20% of organizations reported a breach that targeted AI models or applications. The causes were mostly basic: compromised APIs, applications or plug-ins caused 27% of these breaches, and cloud misconfigurations of AI workloads caused another 27% (IBM Newsroom). Attacks on the model itself cost the most. Model inversion breaches averaged $6.07 million, and prompt injection breaches averaged $5.89 million (IBM).
Figure 1. Attacks on AI cost more than the average breach. Source: IBM Cost of a Data Breach Report 2026. Chart: Uvik Software.
The defense economics are just as clear. Organizations that used security AI and automation extensively cut breach costs by $1.93 million on average and shortened the breach lifecycle by 65 days (IBM).
AI use is outrunning AI control
Employee AI use tripled in one year. 45% of employees are now regular AI users on corporate devices, up from 15%, and 67% of AI users reach AI services through non-corporate accounts (Verizon, DBIR 2026). Breached organizations that reported a shadow AI incident rose from 20% to 43%. In the same period, the share of organizations that require IT approval before AI deployment fell from 45% to 38% (IBM).
Governance is improving, but not fast enough. The share of organizations that assess the security of AI tools before deployment rose from 37% to 64%, yet 87% of leaders call AI-related vulnerabilities the fastest-growing cyber risk (World Economic Forum).
Figure 2. AI use is outrunning AI control. Source: Verizon DBIR, IBM Cost of a Data Breach Report and WEF Global Cybersecurity Outlook, 2025 and 2026 editions. Chart: Uvik Software.
The gap reaches the boardroom. In Grant Thornton’s 2026 survey of 950 business leaders, 78% lacked strong confidence that they could pass an independent AI governance audit within 90 days (Grant Thornton). Only 11% said that their boards met all three of Grant Thornton’s criteria for strong AI oversight (Grant Thornton).
The Uvik Software view
“The 2026 data points to one conclusion. Most AI losses come from AI that an organization already uses without control, not from exotic attacks. Fix inventory, identity and data flows first. Then buy specialist tools.”
Paul Francis, CEO and Founder, Uvik Software
Five shifts that changed enterprise AI risk in 2026
1. AI-enabled attacks became normal
Attackers now use AI across the attack chain. In the Verizon DBIR 2026, the median threat actor used AI assistance in about 15 documented attack techniques (Verizon DBIR 2026). In a Gartner survey of 302 cybersecurity leaders, 62% of organizations had experienced a deepfake attack, 32% an attack on AI applications through the application prompt and 29% an attack on generative AI application infrastructure (Gartner).
2. Shadow AI became the default insider risk
The average organization now records 223 generative AI data policy violations per month, double the prior year, and the top quartile records about 2,100 (Netskope). Verizon ranks shadow AI as the third most common non-malicious insider action in its data loss prevention data, and source code is the data type that employees most often upload to external AI tools (Verizon DBIR 2026).
3. Agents received credentials
Gartner expects 40% of enterprise applications to include task-specific AI agents by the end of 2026, up from less than 5% in 2025 (Gartner, via UC Today). Agents read data, call tools and act with delegated permissions. OWASP responded with a separate Top 10 for Agentic Applications in December 2025, and its Top 10 for LLM Applications 2026 moved Excessive Agency from sixth to third place.
4. Frontier AI compressed the exploit window
In November 2025, Anthropic reported the first documented AI-orchestrated cyber espionage campaign, in which AI executed 80% to 90% of the tactical work against about 30 targets (Anthropic). In April 2026, Anthropic said that its Claude Mythos Preview model had found thousands of high-severity vulnerabilities, including some in every major operating system and web browser, and launched Project Glasswing to fix them with industry partners (Anthropic). Vulnerability exploitation is now the top breach entry point in the Verizon DBIR 2026 (Verizon).
Leaders noticed. In IBM’s follow-on research, 85% of organizations planned to increase security spending after they learned about frontier AI cyber capabilities, against 64% that planned to increase spending after a breach (IBM Newsroom). The practical result: patch speed and exposure management are now board-level metrics.
5. Regulation and standards got firm dates
The EU’s Digital Omnibus on AI entered into force on 27 July 2026. It moved EU AI Act high-risk obligations to 2 December 2027 for Annex III systems and to 2 August 2028 for AI in regulated products under Annex I (European Commission). The Cloud Security Alliance released its AI Controls Matrix v1.1 with 247 control objectives across 18 domains, and NIST published a draft Cyber AI Profile for its Cybersecurity Framework 2.0.
What each executive owns
AI security fails when everyone owns it and nobody decides. Assign decisions, not only tasks. The table shows the decision that only each role can make.
| Role | Owns | Decision only this role can make | First action in 30 days |
|---|---|---|---|
| Board or risk committee | AI risk appetite and oversight | Which AI uses are unacceptable at any return | Put AI risk on the standing agenda and ask for a quarterly scorecard |
| CEO | Mandate and trade-offs | Speed versus control when the two conflict | Name one accountable executive for AI risk |
| CFO | Funding and loss exposure | How much to invest in controls and risk transfer | Fund the 90-day plan and check cyber insurance terms for AI exclusions |
| CIO or CTO | Platforms and architecture | Which models, gateway and agent platform the company approves | Publish the approved tool list and the reference architecture |
| CISO | Security controls and response | Launch gates and kill-switch authority | Add AI incident playbooks and pre-authorize containment |
| General Counsel or CRO | Legal and regulatory exposure | The company’s role for each system under the EU AI Act | Map each AI system to its obligations |
| CDO or head of data | Data rights and quality | Which data each AI system may use | Classify data and publish AI data rules |
| Business owners and VPs | Outcomes of each AI system | Residual risk acceptance for their use cases | Inventory AI in their function and sign ownership |
| HR and people leaders | Acceptable use and training | Consequences of AI misuse | Launch role-based AI training |
Name one accountable executive for AI risk. In most organizations, this is the CISO or the chief risk officer, with the CIO or CTO as the platform owner. Each business owner stays accountable for the outcome of an AI system, even when a vendor supplies the model.
The Uvik Software AI Security Control Stack
Many AI security programs fail in the same way. They put controls inside the model and hope that the model obeys. The Uvik Software AI Security Control Stack separates control from model behavior. It has seven layers, and each layer works even when the model makes a mistake.
Figure 3. The Uvik Software AI Security Control Stack. Source: Uvik Software framework. Chart: Uvik Software.
Rule 1: The model is not a policy engine
A model can classify, draft and recommend. Only deterministic code, with a verified identity and a policy decision, can authorize an action. Design every control on the assumption that the model can be manipulated.
Layer 1: Governance
Keep a complete inventory of models, agents, prompts, datasets, vector stores, tools, MCP servers and vendors. Give each AI system a named business owner, risk owner and technical custodian. Tier each use case by impact, autonomy, data sensitivity and regulatory exposure. AI security posture management (AI-SPM) tools can automate discovery, but a named owner still signs each risk.
Executive test: Can we list every AI system, its owner and its risk tier today?
Layer 2: Identity
Require SSO and MFA for every approved AI tool. Give every agent and workload its own identity, and issue short-lived, task-scoped credentials just in time. Never let an agent reuse a human session token. Apply the zero trust principle of NIST SP 800-207: authenticate and authorize every request, and never trust network location alone.
Executive test: Does every agent have its own identity and a human owner who can revoke it in minutes?
Layer 3: AI gateway
Route all model traffic through one policy enforcement point. The gateway enforces approved providers and models, quotas, prompt and output data loss prevention, logging and trace IDs. It also lets you change providers without rewriting every application. If you integrate models into existing products, build this layer first, because the other controls depend on it. Uvik Software’s AI integration services cover the authentication, data flows and integration work around production models.
Executive test: Does all model traffic pass through a point that we control?
Layer 4: Data
Classify data before it reaches training, tuning, retrieval or inference. Enforce document-, row- and tenant-level permissions before retrieval, not after generation. Record the provenance of every source. Agree residency, retention, deletion and no-training terms with every provider. Permission-aware retrieval is the most effective single control against accidental oversharing.
Executive test: Can our AI assistant retrieve a document that the user cannot open?
Layer 5: Execution
Treat every tool call as a privileged action. Authorize each call at execution time, outside the model, and validate its parameters against strict schemas. Run generated code in sandboxes with deny-by-default network egress. Require human approval for payments, legal commitments, external messages, deletions, deployments and privilege changes. Cap steps, spend, time and fan-out.
Executive test: What is the most expensive action that an agent can take without a human?
Layer 6: Assurance
Threat-model each high-impact AI system against the OWASP Top 10 lists for LLM and agentic applications and against MITRE ATLAS. Red-team the assembled system, not only the base model. Treat every change to a model, prompt, guardrail, retrieval corpus, tool or provider as a release that must pass tests.
Executive test: Which tests must pass before a model, prompt or tool change goes live?
Layer 7: Observability and response
Log enough to reconstruct any significant AI decision, and minimize sensitive content in those logs. Send AI telemetry to the security operations center (SOC). Pre-authorize containment, and test the kill switch, credential revocation and rollback every quarter.
Executive test: How fast can we stop one agent without stopping the business?
Need engineers who build these controls into your AI systems?
Uvik Software matches vetted senior Python and AI engineers to your team within 48 hours of a signed statement of work.
Uvik Software AI Risk Heat Map 2026: 22 scenarios ranked
Uvik Software scored 22 enterprise AI risk scenarios for a typical mid-size to large organization. Inherent risk multiplies likelihood (1 to 5) by impact (1 to 5). Residual risk applies a baseline control effectiveness to each scenario. Three scenarios stay Critical after baseline controls: prompt and goal injection, unexpected code execution and improper output handling. Thirteen scenarios stay High.
Figure 4. Uvik Software AI Risk Heat Map 2026. Source: Uvik Software baseline expert ratings. Chart: Uvik Software.
Figure 5. Inherent versus residual risk for 22 enterprise AI scenarios. Source: Uvik Software baseline expert ratings. Chart: Uvik Software.
The ten highest residual risks, with their OWASP 2026 codes:
| # | Scenario | OWASP 2026 | Inherent | Residual | Priority | Owner | Key controls |
|---|---|---|---|---|---|---|---|
| 1 | Prompt / goal injection | LLM01, ASI01 | 25 | 16.3 | Critical | AppSec | Prompt isolation; tool authorization; red teaming |
| 2 | Unexpected code execution | ASI05 | 20 | 15.0 | Critical | Platform security | Sandbox; deny egress; ephemeral runners |
| 3 | Improper output handling | LLM10 | 20 | 15.0 | Critical | AppSec | Schema validation; encoding; parameterized calls |
| 4 | Excessive agency / tool misuse | LLM03, ASI02 | 20 | 14.0 | High | IAM | Least privilege; approvals; circuit breakers |
| 5 | Agent identity / privilege abuse | ASI03 | 20 | 14.0 | High | IAM | Per-agent identity; short-lived tokens; step-up |
| 6 | AI supply-chain compromise | LLM04, ASI04 | 20 | 13.0 | High | Supply chain | AI bill of materials; signing; trusted registries |
| 7 | MCP / plugin compromise | MCP | 20 | 13.0 | High | Third-party risk | Allowlist; sandbox; change monitoring |
| 8 | Sensitive information disclosure | LLM02 | 20 | 12.0 | High | Data security | DLP; minimization; access control; filtering |
| 9 | Shadow AI use | Enterprise | 20 | 12.0 | High | Security operations | Approved tools; SSE or CASB; DLP |
| 10 | Unbounded consumption | LLM06 | 16 | 12.0 | High | SRE and FinOps | Quotas; timeouts; recursion limits |
Method note: The scores are Uvik Software’s baseline expert ratings, not survey results. Your scores will differ by architecture, data and autonomy level. Re-score each scenario in the free workbook.
Prompt injection leads for a structural reason. Instructions and data share one context window, and no model offers a complete fix. That is why OWASP keeps prompt injection at LLM01 in 2026. The answer is architecture: limit what a hijacked model is able to do.
What the OWASP 2026 update tells executives
OWASP’s Top 10 for LLM Applications 2026, published in August 2026, kept the same ten risk categories but moved eight of them. Excessive Agency rose from sixth to third, Unbounded Consumption rose from tenth to sixth, and System Prompt Leakage became Hidden Context Exposure. Improper Output Handling fell to tenth, although its scope grew. The ranking combines a practitioner vote, weighted at 75%, with evidence from a corpus of 7,714 real incidents.
Figure 6. Agents reshaped the OWASP Top 10 for LLM Applications. Source: OWASP GenAI Security Project, Top 10 for LLM Applications 2025 and 2026. Chart: Uvik Software.
The message for executives is simple. As AI gains tools, the cost of a manipulated model moves from a bad answer to a bad action.
Shadow AI: replace it, do not just ban it
Shadow AI is any AI tool, account, browser extension or agent that employees use without approval. In IBM’s 2026 data, 68% of breached organizations had no policy to govern AI use or manage shadow AI. Shadow AI incidents caused data loss or compromise in 49% of cases and disrupted operations in 42% (IBM).
Bans fail because employees route around them. Approved alternatives work: Netskope found that 47% of generative AI users still use personal accounts, down from 78% a year earlier (Netskope). Give people better approved tools, then enforce the boundary.
- Publish an approved AI tool list within 30 days. Include an enterprise assistant and a coding assistant, both with SSO.
- Block secrets and regulated data from unapproved AI endpoints with data loss prevention at the browser, endpoint and network.
- Require corporate accounts for every approved tool, and detect personal AI accounts on corporate devices.
- Govern AI browser extensions. They can read internal pages and send the content outside your controls.
- Offer a 48-hour request path for new tools, with time-limited exceptions.
- Train each role on the data that must never go into any AI tool.
If you need help to choose approved tools and use cases, Uvik Software’s generative AI consulting service starts with AI readiness and use-case discovery, then adds engineers when implementation begins.
Agentic AI security: identity, autonomy and kill switches
A chatbot talks. An agent acts. Uvik Software measures agent risk as a blast radius with three parts: what the agent can touch, how freely it can act, and how long it takes you to stop it. Reduce any of the three, and the risk falls.
The 2026 data shows a wide gap between agent adoption and agent control. Gravitee’s survey of 919 executives and practitioners found that 88% of organizations had confirmed or suspected AI agent security incidents in the past year. Only 21.9% treat agents as independent, identity-bearing entities, and 45.6% still use shared API keys for agent-to-agent authentication (Gravitee). Okta found that only 34% of organizations apply the same security controls to AI agents as to human workers (Okta).
Figure 7. Agents are in production. Agent identity is not. Source: Gravitee, State of AI Agent Security 2026. Chart: Uvik Software.
Most agent failures will not come from attackers. Gartner predicts that through 2028, at least 80% of unauthorized AI agent transactions will result from internal policy violations, such as oversharing, unacceptable use or misguided agent behavior, rather than from malicious attacks (Gartner, via Opsin). Gartner also predicts that by 2027, 40% of enterprises will demote or decommission autonomous agents because they find governance gaps only after production incidents (Gartner).
The Uvik Software AI Autonomy Ladder
Uniform governance fails both ways: strict rules slow simple agents, and loose rules expose autonomous ones. The Uvik Software AI Autonomy Ladder matches controls to what an agent can do. Controls are cumulative, so each level adds to the controls of the level below.
Figure 8. The Uvik Software AI Autonomy Ladder. Source: Uvik Software framework. Chart: Uvik Software.
| Level | The agent may | Example | Controls to add (cumulative) | Go-live approver |
|---|---|---|---|---|
| 0. Assist | Read and summarize approved sources | Policy question-and-answer assistant | SSO, permission-aware retrieval, logging | System owner |
| 1. Recommend | Propose actions; a human executes them | Draft a refund decision | Output validation, evaluation set, AI disclosure to users | System owner and security reviewer |
| 2. Act with approval | Execute an action after a human approves that action | Send a supplier email after review | Per-action authorization, approval screen with full context, audit trail | Business owner and CISO delegate |
| 3. Act within limits | Execute low-risk actions alone, inside hard limits | Reset passwords; reorder stock under a cap | Own identity, short-lived credentials, spend, step and time limits, anomaly alerts, tested kill switch | Business owner and CISO |
| 4. Act autonomously | Run multi-step workflows across systems and call other agents | End-to-end claims triage | Sandboxing, egress allowlists, signed agent-to-agent messages, circuit breakers, independent assurance, executive risk acceptance | Executive risk owner |
Promote an agent one level at a time, based on measured reliability and a clean incident record. Demote it automatically when a circuit breaker trips. Record each change, and have the accountable owner sign it.
Ten controls every production agent needs
- One identity per agent. No shared human tokens.
- Short-lived, task-scoped credentials, issued just in time.
- Authorization at every tool call, outside the model.
- Separate permissions to read, recommend and execute, with read-only as the default.
- Mandatory human approval for payments, legal commitments, external messages, deletions, deployments and privilege changes.
- Sandboxed code execution with deny-by-default network egress.
- Validated, provenance-aware memory writes that expire.
- Authenticated, signed and replay-resistant messages between agents.
- Circuit breakers on steps, cost, time and fan-out.
- A tested kill switch and safe mode for every production agent.
OWASP Top 10 for Agentic Applications, translated for executives
| Code | Risk | What it means for the business | First control |
|---|---|---|---|
| ASI01 | Agent Goal Hijack | An attacker redirects what the agent tries to achieve, often through a document, email or web page | Treat all external content as untrusted; approve goal changes |
| ASI02 | Tool Misuse and Exploitation | The agent uses a legitimate tool in a harmful way | Per-tool scopes and rate limits |
| ASI03 | Identity and Privilege Abuse | The agent inherits or escalates privileges | Unique identity, least privilege, short-lived tokens |
| ASI04 | Agentic Supply Chain Vulnerabilities | A poisoned tool, plugin, MCP server or model enters the workflow | Allowlisted registry and signed artifacts |
| ASI05 | Unexpected Code Execution | Generated or injected code runs on your systems | Sandbox with no default egress |
| ASI06 | Memory and Context Poisoning | False data persists in memory and steers later decisions | Validated memory writes with expiry |
| ASI07 | Insecure Inter-Agent Communication | Agents trust spoofed or altered messages | Mutual authentication and signed messages |
| ASI08 | Cascading Failures | One error spreads across chained agents | Isolation and circuit breakers |
| ASI09 | Human-Agent Trust Exploitation | People approve what a confident agent proposes | Show evidence; separate approval duties |
| ASI10 | Rogue Agents | An agent acts outside policy and persists | Inventory, behavior monitoring and a kill switch |
Uvik Software engineers build agent orchestration with checkpointed LangGraph flows, MCP tool exposure and permission-aware execution, with recovery paths for failed tool calls (generative AI development). Teams that build agents in-house can compare Python AI agent frameworks on state handling, permissions and failure modes, and can bring in AI agent development services or a LangGraph development company for their highest-risk workflows.
MCP and tool connectors: the new AI supply chain
The Model Context Protocol (MCP) connects AI assistants to tools, APIs and data. Each MCP server acts with delegated permissions, and its tools can change after approval. That makes every server a high-trust integration and a supply-chain dependency.
Gartner predicts that by 2028, 25% of enterprise generative AI applications will experience at least five minor security incidents per year, up from 9% in 2025, partly because MCP was designed for interoperability first (Gartner). Check Point reports security weaknesses in 40% of the 10,000 MCP servers that it analyzed (Check Point).
The OpenClaw agent shows how fast this risk moves. In early 2026, researchers found more than 135,000 internet-exposed instances, a one-click remote code execution flaw (CVE-2026-25253) and 341 malicious skills in its ClawHub marketplace (Admin By Request). Palo Alto Networks Unit 42 later found malicious skills that stayed active after the first clean-up (Unit 42).
- Keep an approved registry of MCP servers, plugins and agent skills. Block everything else.
- Verify each publisher, pin versions and check signatures or checksums.
- Validate tool schemas, and treat all returned content as untrusted input.
- Isolate sessions. Never forward user tokens to third-party servers, and block confused-deputy access.
- Run untrusted servers in a sandbox with egress allowlists.
- Monitor tool descriptions and permissions for change, and re-review after each change.
- Require human approval for sensitive tool actions.
OWASP publishes practical guides to build secure MCP servers and to use third-party MCP servers safely. Uvik Software’s MCP development services team builds MCP servers for internal tools and data. Whoever builds them, require per-user access checks, narrow tool permissions, input validation and audit logs.
AI data security: stop oversharing at the source
AI amplifies existing data access mistakes. If retrieval ignores permissions, an assistant becomes a search engine for everything that it can reach. IBM found that only 37% of breached organizations encrypt sensitive data both at rest and in transit (IBM Newsroom). In Netskope’s data, source code, regulated data and intellectual property are the data types most often involved in generative AI policy violations (Netskope).
- Classify and label data before training, tuning, retrieval or inference.
- Enforce document-, row- and tenant-level authorization before retrieval.
- Separate vector indexes, caches, memory and logs by trust boundary.
- Detect secrets and tokenize sensitive fields before any model call.
- Contract for no training on your data, and set retention, deletion and residency terms.
- Record provenance and integrity for training and retrieval sources, and quarantine new sources until review.
- Keep secrets out of system prompts, and assume that attackers can read any prompt. OWASP now lists this risk as LLM08, Hidden Context Exposure.
Joint CISA, NSA and FBI guidance on AI data security explains why data integrity drives the accuracy and trustworthiness of AI outcomes. Lineage and quality controls are data engineering work: Uvik Software’s data engineering consulting team builds the pipelines, data quality checks and observability that AI retrieval depends on.
AI-generated code: ship faster without new security debt
AI now writes roughly half of all committed code, but its security record has not improved. Veracode’s 2026 report found an average security pass rate of 56% across more than 100 models, almost unchanged from the year before. Coding-specialized models scored no better than general-purpose models, 51% against 52%, and pass rates ranged from 63% for Python to 30% for Java (Veracode).
The lesson for executives: “we use the best model” is not a security strategy. Verification must live outside the model, in the delivery pipeline.
- Treat AI-generated code like third-party code, with the same review, tests and scanning.
- Make static analysis, dependency, secret and infrastructure-as-code scans blocking gates in CI.
- Check every dependency that AI suggests, and block unknown or non-existent packages.
- Give coding agents their own scoped credentials and sandboxed environments.
- Measure change failure rate and time to restore service, not the share of code written by AI.
Our AI coding assistant statistics track adoption, trust and productivity data for engineering leaders. Uvik Software’s AI-augmented software development teams pair AI coding tools with senior engineering review, and senior DevOps engineers can add the security gates to your CI pipeline.
Test, monitor and prove control
Security testing must examine the assembled system: model, prompts, retrieval, tools, identities and the business process around them. Test at least these scenarios before a high-impact launch and after each material change:
- Direct and indirect prompt injection across every input channel, including documents, email, web pages and tool output.
- Secret extraction, cross-tenant retrieval and context leakage.
- Tool authorization bypass, parameter manipulation and unsafe tool chaining.
- Generated code execution and sandbox escape.
- Data, retrieval and memory poisoning.
- Model or artifact substitution and dependency compromise.
- Identity escalation, token replay and confused-deputy conditions.
- Cost exhaustion, infinite loops and fan-out.
- Misleading output in high-impact business scenarios.
- Agent-to-agent spoofing and cascading failure.
- Kill switch, safe mode, rollback and evidence capture.
What to log: the minimum AI trace
- Actor, agent and workload identity.
- Model provider, model and version.
- Prompt template and policy versions.
- Retrieved source IDs and the authorization result.
- Guardrail and policy decisions.
- Tool name, parameters, identity, result and side effect.
- Human approvals and overrides.
- Cost, tokens, latency and loop indicators.
- Final output and its downstream use, with sensitive content minimized.
Detect prompt attack indicators, anomalous retrieval, unusual network destinations, tool-call deviations, privilege changes, bulk data access, repeated guardrail triggers and runaway consumption. Map your detections to MITRE ATLAS to measure coverage. Uvik Software’s LLM evaluation and observability service builds model-based evaluations, semantic regression tests and tracing, so that every release has evidence behind it.
AI incident response: pre-authorize containment
AI incidents move at machine speed, and a response plan that waits for a meeting is too slow. Pre-authorize containment steps, and make them reversible where possible. A practical target is to contain a critical AI incident in 30 minutes or less.
- Stop autonomous actions, or switch the system to recommend-only mode.
- Revoke session and agent credentials, and stop queued work that uses them.
- Disable the affected tool, connector, tenant, capability or model version.
- Isolate network egress and the affected data stores.
- Preserve evidence: model, prompt, retrieval, memory, tool and identity records.
- Roll back to a known-good model, prompt, corpus and policy bundle.
- Notify affected parties and regulators when the law requires it.
Keep playbooks for prompt injection, data leakage, poisoned retrieval or memory, model substitution, unsafe tool actions, rogue agents, credential compromise, unexpected code execution, cost exhaustion and provider outage. Exercise at least one agent injection and exfiltration scenario every quarter. Production AI also needs clear on-call ownership: Uvik Software’s application maintenance and support teams provide L2 and L3 support with root-cause analysis and runbooks.
Third-party AI risk: 12 questions every vendor must answer
Most enterprise AI arrives inside software that you buy. Apply the same standard to bought AI as to built AI, and ask for evidence, not assurances. For deep assessments, the CSA AI Controls Matrix v1.1 provides 247 control objectives across 18 domains, with a 320-question assessment questionnaire.
- Will our inputs or outputs train shared models by default? Show the contract clause and the technical setting.
- Where do you process and store prompts, outputs, embeddings, logs and backups?
- How do you prevent cross-tenant access in caches and vector stores? Show test results.
- Do your agents have unique identities and short-lived credentials?
- Can we scope permissions per tool, action, tenant and environment?
- Can we require human approval for irreversible actions?
- Are execution sandboxes isolated, and can we disable or allowlist network egress?
- Which prompt injection, exfiltration, poisoning and tool-abuse tests do you run? Share the latest report.
- Which prompts, outputs, tool calls and decisions do you log, and can we export them to our SIEM in near real time?
- Can we pin model versions and control upgrades?
- Which kill switch, safe mode and rollback features exist? Demonstrate them.
- What is your incident notification timeline, and how do you revoke agent credentials and contain active jobs?
Write the answers into the contract. Prohibit training on your data without approval, set deletion and incident notification timelines, require notice of model and subprocessor changes, and keep audit and exit rights. The free Uvik Software workbook contains all 40 due-diligence questions, including MCP and agentic checks.
The compliance map: one control library, many obligations
Figure 9. EU AI Act: the dates that matter after the Digital Omnibus. Source: European Commission; Digital Omnibus on AI. Chart: Uvik Software.
The EU AI Act applies by role and by risk level. For each AI system, decide whether your organization acts as provider, deployer, importer or distributor. Most Article 50 transparency obligations apply from 2 August 2026. Synthetic content marking and the new prohibitions added by the Digital Omnibus apply from 2 December 2026. Stand-alone high-risk systems under Annex III, such as AI used in hiring, credit scoring and education, must comply from 2 December 2027. High-risk AI embedded in regulated products under Annex I must comply from 2 August 2028 (European Commission). Fines for prohibited practices reach EUR 35 million or 7% of global annual turnover.
Treat the extra time as runway, not as a reprieve. The obligations did not change, and evidence takes time to build. Counsel should confirm the scope for each system and jurisdiction. This guide is not legal advice.
| Need | Primary baseline | Use it for |
|---|---|---|
| Enterprise cyber risk lifecycle | NIST CSF 2.0 with the draft NIST Cyber AI Profile | Govern, identify, protect, detect, respond and recover for AI |
| AI risk management | NIST AI RMF and its Generative AI Profile | Govern, map, measure and manage AI risk |
| AI management system | ISO/IEC 42001 | A certifiable AI governance system |
| AI risk method | ISO/IEC 23894 | AI risk assessment and treatment |
| Secure development | NIST SSDF and SP 800-218A | AI-specific secure development practices |
| Application and agent threats | OWASP LLM Top 10 2026 and Agentic Top 10 | Threat models, tests and secure design |
| Adversary behavior | MITRE ATLAS | Red teaming and detection coverage |
| Secure AI lifecycle | NCSC and CISA guidelines | Secure design, deployment and operation |
| Cloud AI controls and suppliers | CSA AI Controls Matrix v1.1 | Vendor and cloud AI assessments |
| EU law | EU AI Act | Legal duties by role and risk level |
Do not run each framework as a separate program. Build one control library, map it to each obligation and keep one body of evidence. The Uvik Software control catalog in the free workbook maps 60 controls across 12 domains to these baselines.
The 90-day enterprise AI security plan
Figure 10. The Uvik Software 90-day enterprise AI security plan. Source: Uvik Software framework. Chart: Uvik Software.
| Phase | Action | Owner |
|---|---|---|
| Days 0 to 30: mandate and visibility | Approve the AI security charter and the executive sponsor. | CEO, CRO |
| Form the AI governance council and set decision rights. | CRO | |
| Issue acceptable use and prohibited-data rules. | CISO, Legal | |
| Discover models, agents, APIs, plugins and shadow AI. | CIO, CISO | |
| Require SSO, MFA and approved identities. | IAM | |
| Enable data loss prevention for public AI tools. | Data security | |
| Adopt use-case risk tiers and add an AI incident category. | Enterprise risk, IR lead | |
| Days 31 to 60: architecture and guardrails | Publish secure reference architectures for RAG, copilots and agents. | Architecture |
| Publish the agent identity and credential standard. | IAM | |
| Deploy vendor due diligence and AI contract clauses. | Third-party risk, Legal | |
| Standardize the model gateway and policy enforcement. | AI platform | |
| Add threat modeling, AI bills of materials and release gates. | AppSec, MLOps | |
| Build adversarial and quality test suites, and approve the trace schema. | AI red team, Security engineering | |
| Deliver role-based training for users and operators. | Awareness | |
| Days 61 to 90: prove and operate | Connect high-risk AI telemetry to the SOC. | SOC |
| Red-team the highest-impact production use cases. | AI red team | |
| Run a tabletop exercise on agent injection and data exfiltration. | IR lead | |
| Test the kill switch, credential revocation, rollback and safe mode. | SRE, Product | |
| Create the evidence repository and the executive KPI report. | Compliance, CISO | |
| Months 3 to 12: scale and assure | Expand automated discovery and controls across the enterprise. | CIO, CISO |
| Add independent assurance for high-impact systems. | Internal audit | |
| Assess ISO/IEC 42001 readiness where it supports business goals. | AI governance | |
| Automate release gates, AI bills of materials and evidence capture. | DevSecOps | |
| Complete jurisdiction and sector mappings, and refresh the risk profile every year. | Legal, Compliance |
Free download: Uvik Software Enterprise AI Security Workbook 2026 (XLSX)
60 controls, 22 risk scenarios, 40 vendor questions, 19 KPIs and a 29-action roadmap. No form required. License: CC BY 4.0.
The executive AI security scorecard
Report metrics that connect control operation to business risk. These 12 KPIs fit on one board slide.
| # | KPI | Definition | Target | Cadence | Owner |
|---|---|---|---|---|---|
| 1 | Inventory coverage | AI systems recorded with owner, tier, data and dependencies | 95% or more | Monthly | AI governance |
| 2 | Critical review coverage | High-impact systems with a current threat model and risk review | 100% | Monthly | Enterprise risk |
| 3 | Critical residual risks | Risks that stay Critical after controls | 0 | Weekly | CRO |
| 4 | Unique agent identity | Production agents with their own workload identity | 100% | Monthly | IAM |
| 5 | Short-lived credentials | Agent credentials inside the lifetime policy | 100% | Monthly | IAM |
| 6 | Human approval coverage | High-impact actions that require approval | 100% | Quarterly | Business owners |
| 7 | AI egress coverage | AI workloads with deny-by-default or allowlisted egress | 95% or more | Monthly | Network security |
| 8 | Adversarial test pass rate | Required AI security tests that pass | 100% of critical tests | Per release | AI red team |
| 9 | Critical remediation time | Median days to close critical AI findings | 7 days or less | Monthly | AppSec |
| 10 | Kill-switch test success | Critical systems that meet the safe-mode objective | 100% each quarter | Quarterly | SRE |
| 11 | AI incident containment time | Median time to contain a critical AI incident | 30 minutes or less | Monthly | Incident response |
| 12 | Vendor review coverage | High-risk AI suppliers with a current review | 100% | Quarterly | Third-party risk |
Avoid vanity metrics. A count of blocked prompts means nothing without precision, business context and outcome.
The AI launch gate: 10 conditions before high-impact AI goes live
Use this gate for every high-impact AI system, from internal agents to customer-facing AI chatbots. A system goes live only when all ten conditions are true.
- The system is inventoried, tiered and owned.
- Data flows, model, provider, tools and identities are documented.
- Threat modeling, privacy review and legal review are complete.
- Least-privilege authorization and network controls are tested.
- Adversarial, quality and abuse-case tests pass their thresholds.
- Logging, monitoring and evidence retention work.
- Human oversight, safe mode, rollback and the kill switch are tested.
- Vendor and contract risks are accepted.
- Accountable owners have signed the residual risks.
- Incident responders know how to contain the system.
10 questions boards should ask about AI security
Boards do not need to understand model internals. They need clear answers to these ten questions, ideally on one page every quarter.
- Which AI systems do we run, who owns each one, and what is its risk tier?
- Which AI systems can act without a human, and what is the most expensive action that each one can take?
- Do our agents have their own identities, and can we revoke one in minutes?
- Which data can each AI system read, and can it retrieve data that the user cannot open?
- How much of our AI use happens outside approved tools, and what is the trend?
- Which vendors process our data with AI, and do our contracts forbid training on it?
- What did our last AI red-team exercise find, and what is still open?
- How fast can we contain a critical AI incident, and when did we last test it?
- Which systems fall under the EU AI Act or sector rules, and what evidence do we hold?
- Which residual AI risks have we accepted, who signed them, and when do they expire?
AI security maturity model: score your organization
Score each statement 0 (no), 1 (partly) or 2 (yes), then add the scores. The total places your organization on the Uvik Software AI Security Maturity Model.
Figure 11. The Uvik Software AI Security Maturity Model. Source: Uvik Software framework. Chart: Uvik Software.
| # | Statement | Score (0, 1 or 2) |
|---|---|---|
| 1 | We have a complete AI inventory with an owner and a risk tier for each system. | |
| 2 | Employees have approved AI tools with SSO, and DLP blocks sensitive data from unapproved tools. | |
| 3 | All model traffic passes through a gateway or policy enforcement point that we control. | |
| 4 | Every production agent has its own identity and short-lived, scoped credentials. | |
| 5 | Authorization for every sensitive tool call happens outside the model. | |
| 6 | Retrieval enforces the same permissions as the source systems. | |
| 7 | High-impact AI changes pass security tests and a launch gate before release. | |
| 8 | AI telemetry reaches our SOC, and AI incident playbooks exist. | |
| 9 | We test kill switches, credential revocation and rollback at least every quarter. | |
| 10 | The board receives AI risk metrics at least every quarter. |
| Total score | Level | What it means |
|---|---|---|
| 0 to 5 | Level 1: Unmanaged | AI use is largely unknown. There is no owner, policy or inventory. |
| 6 to 9 | Level 2: Aware | A policy and approved tools exist. The inventory is partial, and controls are manual. |
| 10 to 13 | Level 3: Defined | An inventory, risk tiers, a gateway, an agent identity standard and launch gates exist. |
| 14 to 17 | Level 4: Managed | The board sees AI metrics. Red teaming, SOC detections, kill-switch tests and vendor reviews run on a schedule. |
| 18 to 20 | Level 5: Optimized | Discovery, gates and evidence are automated, with independent assurance and continuous improvement. |
2026 AI security statistics
Uvik Software checked each statistic against its original publisher. Use them freely with a link to the source and to this guide.
Breach economics
- The global average cost of a data breach reached a record $4.99 million in 2026, up 12% (IBM).
- The average breach in the United States cost $11.5 million (IBM).
- One in four malicious breaches was AI-enabled, a 56% increase, at an average cost of $6 million (IBM Newsroom).
- More than 20% of organizations reported a breach that targeted AI models or applications (IBM Newsroom).
- Compromised APIs, applications or plug-ins and cloud misconfigurations each caused 27% of breaches of AI systems (IBM Newsroom).
- Model inversion breaches averaged $6.07 million, and prompt injection breaches averaged $5.89 million (IBM).
- Organizations that used security AI and automation extensively saved $1.93 million per breach and 65 days (IBM).
- Only 37% of breached organizations encrypt sensitive data both at rest and in transit (IBM Newsroom).
- 85% of organizations planned to raise security spending after they learned about frontier AI cyber capabilities, against 64% after a breach (IBM Newsroom).
Shadow AI and the workforce
- 43% of breached organizations reported a shadow AI incident, up from 20%, and these breaches averaged $5.39 million (IBM).
- 68% of breached organizations had no policy to govern AI use or manage shadow AI (IBM).
- 92% of organizations with an AI-related breach lacked proper AI access controls (IBM).
- The share of organizations that require IT approval before AI deployment fell from 45% to 38% (IBM).
- 45% of employees are regular AI users on corporate devices, up from 15% in one year (Verizon).
- 67% of users who reach AI services on corporate devices sign in with non-corporate accounts (Verizon DBIR 2026).
- Shadow AI is the third most common non-malicious insider action in Verizon’s data loss prevention data (Verizon DBIR 2026).
- The average organization records 223 generative AI data policy violations per month, double the prior year (Netskope).
- 47% of generative AI users still use personal accounts, down from 78% a year earlier (Netskope).
AI agents and MCP
- 40% of enterprise applications will include task-specific AI agents by the end of 2026, up from less than 5% in 2025 (Gartner, via UC Today).
- 88% of organizations had confirmed or suspected AI agent security incidents in the past year (Gravitee).
- Only 21.9% of organizations treat AI agents as identity-bearing entities, and 45.6% use shared API keys between agents (Gravitee).
- Only 34% of organizations apply the same security controls to AI agents as to human workers (Okta).
- By 2027, 40% of enterprises will demote or decommission autonomous AI agents because of governance gaps found after incidents (Gartner).
- By 2028, 25% of enterprise generative AI applications will experience at least five minor security incidents per year, up from 9% in 2025 (Gartner).
- By 2029, 15% of enterprise generative AI applications will experience at least one major security incident per year, up from 3% in 2025 (Gartner).
- Check Point found security weaknesses in 40% of the 10,000 MCP servers that it analyzed (Check Point).
AI threats
- 62% of organizations experienced a deepfake attack in the previous 12 months (Gartner).
- 32% of organizations faced an attack on AI applications through the application prompt (Gartner).
- In the first documented AI-orchestrated espionage campaign, AI executed 80% to 90% of the tactical work (Anthropic).
- Anthropic’s Claude Mythos Preview found thousands of high-severity vulnerabilities, including some in every major operating system and web browser (Anthropic).
- Vulnerability exploitation is the top breach entry point in the Verizon DBIR 2026 (Verizon).
AI-generated code
- AI-generated code passes security tests only 56% of the time on average, a rate almost unchanged in a year (Veracode).
- Coding-specialized models scored 51% on security tasks, against 52% for general-purpose models (Veracode).
Governance and regulation
- 64% of organizations assess the security of AI tools before deployment, up from 37% (World Economic Forum).
- 87% of leaders say that AI-related vulnerabilities are the fastest-growing cyber risk (World Economic Forum).
- 78% of business executives lack strong confidence that they could pass an independent AI governance audit within 90 days (Grant Thornton).
- EU AI Act high-risk obligations apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems (European Commission).
- The CSA AI Controls Matrix v1.1 contains 247 control objectives across 18 domains (Cloud Security Alliance).
How Uvik Software helps security and engineering leaders
Uvik Software is a senior-only Python, AI and data engineering company. It was founded in 2015, is headquartered in Tallinn, Estonia, and has a commercial office in Ipswich, United Kingdom. More than 50 senior engineers, with 7 to 14 years of production experience, embed directly into client teams. Uvik Software is a member of the Claude Partner Network, a Databricks Bronze partner and a member of the Python Software Foundation, with a 5.0 rating across 38 verified Clutch reviews.
Security and engineering leaders bring Uvik Software in when they need engineers who build controls into AI systems, not around them.
- Close the AI skills gap fast. AI staff augmentation and senior AI/ML engineers arrive as matched profiles within 48 hours of a signed statement of work and typically embed within 2 weeks.
- Put engineers next to the business. Forward deployed engineering embeds senior engineers with the teams that will use your AI systems.
- Harden the code around your models. Python development services cover the APIs, integrations and production services that enforce your controls.
- Check the evidence. Uvik Software case studies document production AI projects with measured outcomes.
Uvik Software signs an NDA before you share product or code details, and the client owns the IP (how we work). The company follows an ISO/IEC 27001-aligned approach to information security, implements SOC 2-aligned controls and shares its security package during vendor onboarding.
Talk to a Uvik Software engineering lead
Book a 30-minute discovery call with an engineering lead, not a sales representative.
The five original Uvik Software frameworks in this guide are the AI Security Control Stack, the AI Risk Heat Map 2026, the AI Autonomy Ladder, the 90-Day Enterprise AI Security Plan and the AI Security Maturity Model. Uvik Software reviews this guide every quarter. Next review: January 2027.
Methodology, sources and how to cite this guide
Uvik Software reviewed 2025 and 2026 primary sources from IBM and the Ponemon Institute, Verizon, Gartner, the World Economic Forum, OWASP, NIST, the Cloud Security Alliance, the European Commission, Netskope, Veracode, Okta, Gravitee, Grant Thornton, Anthropic, Check Point and Palo Alto Networks Unit 42. Each statistic links to its publisher. Where a figure comes from a full report rather than a press release, the link points to the report page. The risk scores, frameworks, control catalog and 90-day plan are Uvik Software’s own analysis.
The five original Uvik Software frameworks in this guide are the AI Security Control Stack, the AI Risk Heat Map 2026, the AI Autonomy Ladder, the 90-Day Enterprise AI Security Plan and the AI Security Maturity Model. Uvik Software reviews this guide every quarter. Next review: January 2027.
How to cite this guide
Uvik Software (2026). Enterprise AI Security Guide 2026: The C-Suite Playbook. https://uvik.net/blog/enterprise-ai-security-guide/
Charts and the workbook are free to reuse under CC BY 4.0. Credit “Uvik Software” and link to this page.
Sources
- IBM, Cost of a Data Breach Report 2026 (conducted by Ponemon Institute), July 2026
- IBM Newsroom, “IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on Average”, 29 July 2026
- Verizon, 2026 Data Breach Investigations Report
- Verizon News, “Vulnerability exploitation top breach entry point, 2026 industry-wide DBIR finds”
- Gartner, “Gartner Says Applying Uniform Governance Across AI Agents Will Lead to Enterprise AI Agent Failure”, 26 May 2026
- Gartner, “Gartner Predicts 25% of All Enterprise GenAI Applications Will Experience At Least Five Minor Security Incidents Per Year By 2028”, 9 April 2026
- Gartner, “Gartner Survey Reveals GenAI Attacks Are on the Rise”, 22 September 2025
- UC Today, “Gartner predicts 40% of enterprise apps will feature AI agents by 2026”
- Opsin, “Gartner Market Guide for Guardian Agents: What We Believe It Means for Enterprise AI Security”
- World Economic Forum, Global Cybersecurity Outlook 2026, Executive summary, January 2026
- Netskope Threat Labs, Cloud and Threat Report: 2026
- Veracode, 2026 GenAI Code Security Report (press release), 28 July 2026
- Gravitee, State of AI Agent Security 2026 Report, 4 February 2026
- Okta, AI Agents at Work 2026
- Grant Thornton, 2026 AI Impact Survey
- Grant Thornton, “Make your board a springboard for AI benefits”, 2026
- Anthropic, “Disrupting the first reported AI-orchestrated cyber espionage campaign”, November 2025
- Anthropic, Project Glasswing, April 2026
- Check Point, AI Security for Enterprises (Check Point 2026 Cybersecurity Report findings)
- Admin By Request, “OpenClaw Went from Viral AI Agent to Security Crisis in Just Three Weeks”, 2026
- Palo Alto Networks Unit 42, “OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat”, 2026
- OWASP GenAI Security Project, Top 10 for LLM Applications 2026, August 2026
- OWASP GenAI Security Project, Top 10 for Agentic Applications for 2026, December 2025
- European Commission, AI Act Service Desk: Timeline for the implementation of the EU AI Act
- NIST, Cybersecurity Framework Profile for Artificial Intelligence (IR 8596, preliminary draft), December 2025
- Cloud Security Alliance, AI Controls Matrix v1.1, 2026
About the author
Paul Francis is the CEO and founder of Uvik Software. He founded the company in 2015 and leads its senior Python, AI and data engineering practice.
