Security News Heimdal Survey: Executives Four Times More Confident About AI Risk Than the Teams Managing It

Brownie2019

Brownie2019

Level 23
Thread author
Verified
Well-known
Forum Veteran
Mar 9, 2019
1,035
5,296
2,168
Germany
Content source
https://hackread.com/heimdal-survey-executives-four-times-more-confident-about-ai-risk-than-the-teams-managing-it/
London, United Kingdom, June 17th, 2026, CyberNewswire

New research from cybersecurity company Heimdal finds 29% of US executives say AI risk is under control, against 7% of the practitioners running it day-to-day. Across 1,000 IT professionals in the UK and US, AI adoption has outpaced security controls by roughly two to one.

Heimdal today published The State of AI Risk Management in 2026, a survey of 1,000 IT professionals across the United Kingdom and the United States.

The report’s headline finding is a divide inside the same organizations: the closer a person sits to the day-to-day running of AI, the less confident they are that the risk is contained. In the US, 29% of C-suite and VP respondents say their organization has AI risk under control, against 7% of the mid-level practitioners managing it.

In the UK, the gap runs the same way, 18% to 11%. Both gaps are statistically significant.

AI tools are already present across most IT estates, and most teams run several at once.

The controls have not kept pace. Across both markets, the report finds adoption has outrun security controls by roughly two to one.

The survey also records a counterintuitive pattern: the teams that see their AI use most clearly are the most concerned about it, not the least.

Heimdal’s report describes visibility as the diagnosis rather than the cure.
Click to expand...
Read the full Story:
hackread.com

Heimdal Survey: Executives Four Times More Confident About AI Risk Than the Teams Managing It

London, United Kingdom, 17th June 2026, CyberNewswire
hackread.com hackread.com
 
  • Like
  • HaHa
Reactions: lokamoka820, brambedkar59 and Sorrento
Brownie2019 said:
Read the full Story:
hackread.com

Heimdal Survey: Executives Four Times More Confident About AI Risk Than the Teams Managing It

London, United Kingdom, 17th June 2026, CyberNewswire
hackread.com hackread.com
Click to expand...
The confidence gap described there is believable in general terms: executives often see AI as a strategic enabler, while the people integrating and securing it see the messy realities (shadow AI use, data exposure risks, unclear ownership, and fast-changing tooling).

What this usually indicates (without assuming Heimdal’s numbers are perfect)
  • Different “definitions of control.” Leadership may mean “we have a policy,” while practitioners mean “we can actually detect, prevent, and audit risky use.”
  • Visibility increases concern. When teams finally inventory AI usage, they often discover more tools, more data flows, and more unmanaged endpoints/SaaS than expected.
  • Controls lag adoption. AI gets turned on inside existing platforms (M365/Google/work apps, browsers, developer tools) faster than governance, logging, and DLP rules are updated.

Main risk areas that tend to drive practitioner concern
  • Data leakage (employees pasting sensitive content into chatbots; copilots indexing content too broadly; screenshots and exports).
  • Unauthorized tools (“shadow AI”) used outside approved environments and outside logging.
  • Over-permissive access (AI tools inherit broad permissions from the identity/account or from shared drives).
  • Supply chain / vendor risk (where prompts and files go, retention, training use, subprocessors).
  • Integrity risks (AI-generated output used without validation in code, IT changes, finance, HR, or security workflows).
  • Prompt injection / indirect injection when AI is connected to internal data, tickets, email, or web content.

Practical controls that usually close the “2x adoption vs controls” gap
  • Inventory and classification first
    • List approved AI tools and explicitly block/limit unapproved ones where feasible (web filtering/CASB, endpoint controls, browser controls).
    • Classify which data types are allowed in which tools (public, internal, confidential, regulated).
  • Identity and access hardening
    • Enforce MFA and conditional access for AI/SaaS.
    • Apply least privilege to the data sources AI can access (SharePoint/Drive/Confluence/Jira, etc.).
  • DLP and logging
    • Enable DLP policies for prompt/file uploads where your platform supports it.
    • Centralize audit logs (SIEM) for AI tool access, file sharing, and admin changes.
  • Governance and “who owns it”
    • Assign an accountable owner (security + legal/privacy + IT + business unit).
    • Document retention, training use, and contractual terms for each vendor.
  • Secure-by-default enablement
    • Roll out approved AI with guardrails rather than trying to ban everything (users will route around bans).
    • Create short, enforceable rules: “no secrets, no customer PII, no credentials, no proprietary source code” unless explicitly approved and technically protected.
  • Validation for high-impact use
    • Require human review for AI-assisted code, security detections, HR/finance decisions, and customer communications.
    • Treat AI output as untrusted input in workflows and tooling.

How to read the article safely
It’s still worth treating this as a single survey and checking the underlying report details (sampling, role definitions, questions asked). The overall takeaway remains useful: confidence without measured controls (inventory, logging, DLP, access governance) is usually optimism, not assurance.

Sources
 

You may also like...