95% of CISOs feel pressure to suppress or delay compliance-related security issues when business deadlines are at stake.

88% of organizations include vibe coding in formal production policies.

0% of organizations ban vibe coding outright.

Organizations relying on shared ownership are 47% less likely to detect rogue AI behavior.

65% of CEOs believe they have a full AI inventory.

15% of security leaders cite misalignment with internal security policies as a major concern with AI-generated code.

48% of technical leaders believe they have a full AI inventory.

Over half of US CISOs track AI as a dedicated risk category.

53% of organizations have a board member involved in or leading a cyber risk assessment committee.

53% of enterprises operate AI agents autonomously for low-risk tasks while applying human review for higher-risk actions.

33% of IT and security leaders have only partial control over the use of agentic AI in their organizations.

Only 21% of enterprises have formal decommissioning processes for AI agents.

38% of enterprises require human approval when AI agents exceed their scope.

53% of enterprises use human authorization as a primary signal for governing AI agent behavior.

79% of enterprises say context-aware controls will be important or very important in the next two years.

57% of C-suite executives believe their organization consistently meets remediation SLAs, yet only 15% of security practitioners agree.

79% of General Counsels lack confidence that current board reporting strikes the right balance between clarity and overload.

Only 19% say their organization’s GRC systems are fully integrated, 65% say they are somewhat integrated, and 16% report no integration at all.

63% of enterprises use action risk as a primary signal for governing AI agent behavior.

42.4% of teams address AI separately from standard governance structures.