Kiteworks 2026 Forecast Finds AI Adoption Outpacing Data Security Controls
Summary
Kiteworks' survey of 225 leaders finds widespread AI containment gaps: 63% lack purpose binding and 60% lack kill switches. Its 2026 forecast prioritizes containment, training-data governance and third-party visibility.
Key points
- Kiteworks and Centiment surveyed 225 security, IT, compliance and risk leaders across 10 industries and eight regions in Q4 2025; 97% represented organizations with at least 1,000 employees.
- Every surveyed organization had agentic AI on its roadmap, but 63% lacked purpose binding, 60% lacked kill switches and 55% lacked network isolation.
- Training-data safeguards were limited: 78% lacked pre-training validation, 77% lacked provenance and lineage capabilities, and 53% lacked training-data recovery.
- Only 36% reported visibility into partners' AI data handling; 89% had never practiced incident response with third-party vendors and 87% lacked joint response playbooks.
- AI governance was outside the top five board topics for 54% of respondents. The report associates this with lower AI-control maturity, rather than establishing causation.
- Government respondents reported particularly large gaps: 90% lacked purpose binding, 76% lacked kill switches and 33% had no dedicated AI controls.
- The forecast recommends prioritizing agent containment, joint incident-response planning, training-data governance and visibility into cross-border AI processing.
Article Details
- Publisher
- Kiteworks
- Report Period
- 2026 forecast based on a survey fielded in Q4 2025
- Scope
- Enterprise AI data security, governance, compliance, incident response, and third-party risk across 10 industries and 8 regions.
- Sample Size
- 225 security, IT, compliance, and risk leaders; 97% represent organizations with 1,000+ employees.
- Key Statistics
- All surveyed organizations reported agentic AI on their roadmap, while only 37% had purpose binding and 40% had kill switches.
- Among respondents, 78% lacked pre-training data validation, 77% lacked training-data provenance and lineage, and 53% lacked AI training-data recovery.
- 54% did not rank AI governance among their board's top five topics; the report associates this with 26–28 percentage-point gaps on AI maturity metrics.
- 89% had never practiced incident response with third-party vendors, and 87% lacked joint incident response playbooks.
- 33% lacked evidence-quality audit trails, and 61% had fragmented data exchange approaches that the report associates with fragmented logs.
- Recommendations
- Implement agent kill switches, purpose binding, and network isolation; restrict tool execution and enforce allowlists for agent runtimes and connectors.
- Establish joint incident response playbooks and conduct exercises with critical partners.
- Consolidate data exchange infrastructure to support unified, evidence-quality audit trails.
- Build training-data governance covering validation, provenance, recovery, and unlearning-ready architecture.
- Make AI governance a standing board agenda item and require visibility into third-party AI handling and cross-border processing.
Threat Actors
Products
Countries
Australia- **Australia is the benchmark:** +10–20 points on nearly every metric, with the strongest pipelines. Leading on AI adoption AND controls.France| France | 40% | Lower |Germany| Germany | 48% | 60% |Saudi Arabia| Saudi Arabia | 86% | High |UAE| UAE | 19 points | 31% |United Kingdom| United Kingdom | 56% | Moderate |United States| United States | 71% | 58% | 62% |
Industries
Financial Services| Financial Services | 6 points | 15% |Government| 3 | Centralized AI gateways become the control plane | 57% non-centralized; 33% of government has no dedicated AI controls | High |Healthcare| Healthcare | 20 points | 32% |Manufacturing| Manufacturing | 52% | Low |Professional Services| Professional Services | 33% | 0% |Technology| Technology | 4 points | 12% |