Kiteworks has released findings from its AI Data Security and Compliance Risk Survey, based on responses from 461 cybersecurity, IT, risk management, and compliance professionals. The survey, conducted by Centiment, reveals significant implementation failures: only 17% of organizations have technical controls that both block access to public AI tools and include data loss prevention (DLP) scanning. Additionally, 26% report that over 30% of the data employees use to prompt AI tools includes private information.
These findings emerge amid a well-documented surge in AI-related incidents. Stanford’s 2025 AI Index Report recorded a 56.4% year-on-year increase in AI privacy incidents, reaching 233 last year. The Kiteworks survey shows that organizations remain underprepared: 40% control AI tool usage through training and audits, 20% rely solely on warnings without monitoring, and 13% lack any specific policies governing public AI tool usage.
“Our research reveals a fundamental disconnect between AI adoption and security implementation,” said Tim Freestone, Chief Marketing Officer at Kiteworks. “When only 17% have technical blocking controls with DLP scanning, we’re witnessing a systemic governance failure.”
A dangerous overconfidence gap
The Kiteworks survey exposes a critical overconfidence gap in AI governance readiness. One-third of survey respondents claim they have comprehensive governance controls and tracking in place. However, this sharply contrasts with Gartner’s findings: only 12% of organizations have dedicated AI governance structures, and 55% lack any governance framework at all. This dramatic gap between perception and reality creates substantial risk exposure.
Deloitte’s research provides further context: only 9% of organizations reach the ‘Ready’ level of AI governance maturity, despite 23% claiming to be ‘highly prepared’—a 14-point overconfidence gap.
“The gap between self-reported capabilities and measured maturity represents a dangerous form of organizational blindness,” stated Patrick Spencer, VP of Corporate Marketing and Research at Kiteworks.
Lack of consensus on how to manage vulnerabilities
Despite widespread awareness of risks, the Kiteworks survey found little consensus on how organizations are managing vulnerabilities:
- 34% report using a balanced approach, combining data minimisation with selective privacy-enhancing technologies.
- 23% maintain comprehensive privacy controls, including regular audits.
- 10% have basic privacy policies but prioritise AI innovation.
- 10% address privacy concerns reactively, focusing on compliance only when legally required.
- 23% have no formal privacy controls and prioritise rapid AI adoption.
Given the convergence of weak controls, limited visibility, and escalating threats, Kiteworks advises that organizations must:
- Acknowledge reality: Recognise that self-assessed governance may significantly overstate actual maturity when compared with industry benchmarks.
- Deploy verifiable controls: Implement automated governance tracking and enforceable controls that can demonstrate compliance, rather than merely claiming it.
- Prepare for regulatory scrutiny: Quantify exposure gaps and prioritise measurable improvements to mitigate emerging risks.
