Optro

34% of enterprises allow AI agents to modify controls or policies.

34% of organizations report they have experienced an inaccurate AI agent decision or output that was acted upon.

30% of organizations have seen an AI agent take an unintended action.

85% of organizations have integrated AI into core operations.

Only 25% of organizations have comprehensive visibility into how employees are using AI.

58% of leaders believe their governance controls are keeping pace with AI adoption.

82% of IT, security, audit, and GRC professionals report an increase in AI-enabled attacks over the last 12 months.

72% of Chief Information Security Officers report a significant increase in attacks, led primarily by AI-powered social engineering.

Only 18% of organizations automatically block unauthorized AI domains.

82% of organizations report an increase in AI-enabled attacks over the past year.

Roughly 80% of organizations describe 'shadow AI' use as moderate to pervasive.

In the past 12 months, 40% of organizations report inaccurate outputs from AI.

25% of organizations have experienced a control failure involving an AI agent.

46% of organizations report employees are spending more time reviewing, validating, or correcting AI outputs.

96% of GRC and audit leaders agree that workflows should adapt to leverage AI capabilities.

27% of enterprises permit AI agents to change user permissions or access rights.

Only 9% of GRC and audit leaders have redesigned workflows to safely accommodate AI agents.

38% of enterprises authorize AI agents to approve or reject transactions.

Only 18% of leaders have active risk mitigations in place for AI.

In the past 12 months, 40% of organizations reported inaccurate AI outputs.

In the past 12 months, 27% of organizations reported data breaches tied to AI use.

In the past 12 months, 26% of organizations reported regulatory action tied to AI use.

30% of organizations have never tested for agentic AI failure (loss of control or autonomous decision-making failures).

Nearly two-thirds of organizations experienced an AI agent-related incident in the past 12 months, resulting in data exposure, operational disruption, and financial losses.

One in three organizations use AI in critical resilience workflows.

Only 34% of organizations maintain a formal AI model inventory.

42% of Chief Information Security Officers say insufficient focus on AI governance is their primary concern about the future policy environment.

56% of organizations use embedded AI within third-party vendor tools that employees often do not recognize as using AI.

Over two-thirds of GRC and security leaders are only "somewhat confident" or "not very confident" that their organization can respond decisively to a fast-moving AI security incident.

23% of Chief Information Security Officers cite lack of AI security expertise as their top barrier.

No single function owns more than 25% of AI governance responsibility.

In the past 12 months, 26% of organizations report regulatory actions related to AI.

In the past 12 months, 27% of organizations report AI-related data breaches.

25% of organizations have comprehensive visibility into employee AI use.

85% of organizations have integrated AI into core operations or multiple functions.