The State of AI Security & Governance in Organizations

    Findings from a Primary Research Study of 23 Cybersecurity, IT, GRC (Governance, Risk, Compliance), and AI Professionals

    Joshua Khokhar, Founder & CEO, CRIT Cyber · Version 1.0 · Published July 2026 · Study period: November 2025 to February 2026

    Download the Free Report (PDF, 0.7 MB)

    Free direct download. No email required.

    About the Study

    Between November 2025 and February 2026, CRIT Cyber interviewed 23 cybersecurity, IT, GRC, and AI professionals about how their organizations govern internal AI usage. Participants came from financial services, healthcare, government and defense, higher education, technology consulting, engineering, and AI software.

    The study surfaced eight findings. Among them: 22 of 23 professionals cited data leakage or shadow AI as a primary security concern, yet none of the 23 organizations had technical enforcement covering the full scope of their stated AI policy. At one mid-market financial institution, 94 distinct AI products were identified in active use, with roughly 600 employees using ChatGPT against only 200 officially approved users.

    The full report includes the methodology, participant overview, the ethics and conflict of interest disclosure, limitations, and the complete interview guide.

    The Study in Four Numbers

    22 of 23

    professionals cited data leakage or shadow AI as a primary security concern

    0 of 23

    organizations had technical enforcement covering the full scope of their stated AI policy

    94

    distinct AI products identified in active use at one mid-market financial institution

    600 vs 200

    employees actively using ChatGPT at that institution, against only 200 officially approved users

    Selected Findings in Charts

    Four statistics from the study: 94 AI products found at one financial institution, 600 employees using ChatGPT against 200 approved, zero organizations with full technical enforcement, and 22 of 23 professionals citing data leakage or shadow AI as a primary concern.
    Shadow AI is not an edge case. Key indicators from one mid-market financial institution and across the study (Finding 1).
    Bar chart of security concerns raised across the 23 interviews: data leakage and shadow AI each raised by 96 percent of participants, policy without technical enforcement by 87 percent, IP leakage and AI-generated code ownership by 78 percent, autonomous agent risk by 52 percent, regulatory compliance by 48 percent, prompt injection by 30 percent, and AI bias, ethics, and explainability by 22 percent.
    How often each security and compliance concern came up across the 23 interviews.
    Five-level AI governance maturity spectrum from the study: Level 1 Wild West with no policy or controls, Level 2 policy without enforcement, the most common posture, Level 3 managed adoption with approved tool lists but substantial shadow AI, Level 4 structured governance with an executive mandate and shadow AI detection, and Level 5 security-first mature with Zero Trust applied to AI and all non-vetted LLMs blocked.
    The five levels of AI governance maturity observed across participating organizations. Most sit at Level 2 or 3 (Finding 5).

    The Eight Findings

    1. Data leakage and shadow AI were near-universal concerns, yet rarely subject to technical control.
    2. A gap between stated policy and technical enforcement was the central governance failure observed.
    3. AI adoption was predominantly bottom-up, while effective governance required executive sponsorship.
    4. Restriction without education was reported to fail and to introduce new risks.
    5. Governance maturity varied widely across participating organizations.
    6. Autonomous AI agents emerged as an unaddressed governance frontier.
    7. Established audit cycles were perceived as unable to keep pace with AI's rate of change.
    8. Mid-market organizations reported being underserved by existing tools.

    "AI policies are expected to be followed by the employees. Most of the time there are no technical restraints preventing them from accessing public AI tools and entering sensitive data."

    Jonathan Hornbeck, Founder & Consultant, Efficient Futures LLC

    Taken together, the findings point to a substantial and growing unmet need for accessible AI governance capabilities, particularly among mid-market organizations that lack the resources to build enterprise-scale security infrastructure but bear the same data protection obligations as larger peers.

    Read the full 30-page report, including the methodology, participant overview, limitations, and interview guide.

    Download the Free Report (PDF, 0.7 MB)

    How to Cite This Report

    Khokhar, J. (2026). The State of AI Security & Governance in Organizations: Findings from a Primary Research Study of 23 Cybersecurity, IT, GRC, and AI Professionals (Version 1.0). CRIT Cyber LLC.

    Questions about this research: joshua@critcyber.com

    About CRIT Cyber

    CRIT Cyber is building CRITGuard, the AI security gateway from CRIT Cyber. CRITGuard helps organizations monitor, govern, and control AI usage internally, with shadow AI discovery, real-time data loss prevention, policy enforcement, and compliance reporting for mid-market organizations.