McKinsey Survey Finds Cybersecurity a Leading AI Risk as Governance Lags
Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.
Summary
McKinsey’s 2026 survey of about 500 organizations finds AI-trust maturity improving but governance and agentic controls lagging; respondents cite cybersecurity as a leading risk. A companion article outlines six ways to strengthen AI compliance.
Key points
- The survey gathered responses from about 500 organizations between December 2025 and January 2026; average responsible-AI maturity rose to 2.3 from 2.0 in 2025.
- Only about one-third of organizations reached maturity level 3 or higher in strategy, governance, and agentic AI governance.
- Nearly two-thirds of respondents cited security and risk concerns as the top barrier to scaling agentic AI; 72% identified cybersecurity as a highly relevant AI risk.
- Respondents reported gaps between risk awareness and active mitigation, particularly for intellectual property infringement and personal privacy.
- About 8% of organizations reported AI-related incidents, a share described as stable; nearly 60% of respondents whose organizations experienced incidents had satisfactory or negative views of the response.
- Organizations with explicit RAI ownership had higher average maturity scores than those without a clearly accountable function: 2.6 versus 1.8.
- A companion article recommends centralizing compliance oversight, digitizing controls, training employees, building resilient AI systems, and continuously monitoring and improving compliance.
Article Details
- Publisher
- McKinsey
- Report Period
- December 2025-January 2026 (survey period)
- Scope
- AI trust maturity and responsible AI practices across organizations, industries, and regions.
- Sample Size
- Approximately 500 organizations.
- Key Statistics
- Average RAI maturity score was 2.3 in 2026, up from 2.0 in 2025.
- 74% of respondents identified inaccuracy as a highly relevant AI risk; 72% cited cybersecurity.
- Approximately 8% of organizations reported AI-related incidents.
- Nearly two-thirds of respondents cited security and risk concerns as the top barrier to scaling agentic AI.
- Nearly 60% cited knowledge and training gaps as the primary barrier to implementing RAI practices, up from about 50% the previous year.
- Recommendations
- Anchor AI compliance accountability within the risk or compliance function.
- Review controls and automate repetitive, time-intensive, or error-prone compliance tasks.
- Simplify governance structures and standardize compliance efforts across the organization.
- Provide targeted, role-specific employee training on data privacy, ethical AI, and regulatory compliance.
- Continuously monitor and improve policies, controls, and governance structures.
People
Abby StichaCoauthored the article on findings from McKinsey’s 2026 AI Trust Maturity Survey.Anselm OhmeCoauthored the article on digital and AI compliance.Cécile PrinsenCoauthored the article on findings from McKinsey’s 2026 AI Trust Maturity Survey.Fares DarwazehCoauthored the article on digital and AI compliance.Gabriel Morgan AsafteiCoauthored the article on findings from McKinsey’s 2026 AI Trust Maturity Survey.Henning SollerCoauthored the article on digital and AI compliance.Roger RobertsCoauthored the article on findings from McKinsey’s 2026 AI Trust Maturity Survey.Thao DürschlagCoauthored the article on digital and AI compliance.