AI Access Amplifies Data Risks, Threatening Enterprise Security

  • Thales' 2026 Data Threat Report, conducted by S&P Global 451 Research, found 61% of organizations cite AI as their top data security risk.
  • The report highlights a concern that AI systems, increasingly granted broad data access, are becoming 'trusted insiders' with potentially weak controls.
  • Only 34% of organizations know where all their data resides, and 47% of sensitive cloud data remains unencrypted.
  • Nearly 60% of companies have experienced deepfake-driven attacks, and credential theft remains the leading attack technique (67%).
  • While 30% now dedicate specific budgets to AI security, 53% still rely on traditional security programs not adapted for automated systems.

The Thales report underscores a critical shift in the threat landscape: AI is not just a tool for innovation but also a potential vector for data breaches, amplifying existing vulnerabilities and creating new ones. This trend highlights the inadequacy of traditional security models built around human users and perimeter defenses, demanding a fundamental rethinking of data governance and access control as AI becomes increasingly embedded in enterprise operations. The risk extends beyond malicious AI, encompassing the unintended consequences of granting automated systems broad access without adequate oversight.

Governance Dynamics
The disconnect between AI adoption and data control will likely force a reassessment of access policies and data visibility frameworks across industries, potentially leading to stricter regulatory oversight.
Execution Risk
The slow pace of security investment relative to AI’s expansion creates a significant execution risk for organizations, as they struggle to adapt existing infrastructure and expertise.
Regulatory Headwinds
Increased awareness of AI-driven attacks and data breaches will likely spur regulatory bodies to mandate enhanced data security measures and accountability for AI deployments.