Artificial intelligence has quickly evolved from isolated pilot projects into a core part of business operations. McKinsey's 2025 State of AI report notes that 88% of organizations use AI in at least one area, yet nearly two-thirds have not scaled it across the company. The report also found that only 39% of organizations report enterprise-wide improvements in earnings before interest and taxes (EBIT) from AI, highlighting the gap between adopting AI and generating measurable business value. Organizations must also establish the governance, security, and operational foundations needed to scale AI responsibly.

Zero trust has transformed cybersecurity by replacing implicit trust with continuous verification. Organizations now verify identities, limit privileges, and monitor activity instead of relying on network location. Those principles still apply, but AI expands how they need to be used. Organizations must extend zero trust to non-human identities, autonomous systems, and model-driven interactions that affect enterprise data access and use.

AI models aggregate information from multiple sources, generate business insights, and increasingly power agents that act on users' behalf. Organizations must secure not only users and devices, but also models, prompts, retrieval systems, and AI agents. This is a significant concern: KPMG found that 44% of U.S. workers use unauthorized AI tools, and 46% have uploaded sensitive company information to public AI platforms.

AI Is Redefining What Zero Trust Must Protect  

A common misconception is that AI security begins with protecting the model. In reality, it starts with securing the data. Enterprise AI is only as reliable as the data it securely accesses. Protecting the model alone is not enough. Organizations must ensure the data powering AI is accurate, governed, and protected in every environment, whether that’s in the cloud, on-premises, or at the edge. Without this foundation, trust erodes and risks to security, compliance, and data exposure increase.

Many organizations believe governance slows AI adoption by adding controls. However, PwC's 2025 Responsible AI Survey found that 58% of business leaders believe responsible AI use improves ROI and output. This reflects a broader shift: governance is now viewed as a foundation for scaling AI responsibly and generating lasting business value, rather than as a constraint.

Governance also applies to how AI agents interact with enterprise data. Unlike traditional AI assistants, these systems retrieve information, interact with business applications, and complete tasks for users. They require the same access controls, monitoring, and audit capabilities as human users.

Zero trust must apply throughout the AI lifecycle, especially during inference, when models access enterprise data and generate critical outputs. Every inference request should be authenticated, authorized, monitored, and logged, as with human users. These protections must be consistent across on-premises, private cloud, and public cloud environments. Unified governance lets organizations bring AI to their data, reducing complexity while maintaining visibility and control.

Extending zero trust in AI does not require organizations to start from scratch. Organizations can expand existing identity, access management, encryption, and monitoring capabilities to support AI systems.  

●      The first step is to identify where AI is being used, what data models and agents can access, and which systems they interact with.  

●      From there, organizations should extend identity-based access controls to AI, establish governance policies for models and agents, continuously monitor AI activity, and maintain audit records that provide visibility into how AI systems retrieve, process, and act on enterprise data.

Banks have long relied on strict identity verification, granular access controls, and comprehensive audit trails to protect customer data. The same principles should extend to AI. Organizations need visibility into how models are trained, what data they can access, and how AI-generated outputs are used across the business.

Consistency Is the Foundation of AI Security  

Enterprise AI now includes foundation models, APIs, cloud services, retrieval systems, AI agents, and distributed data, creating complex trust relationships. IBM found that 91% of executives do not fully understand these AI connections, making them difficult to secure. Organizations need consistent governance, encryption, monitoring, and access controls, regardless of where AI operates. Applying uniform policies across environments reduces complexity and enables organizations to deploy AI where it delivers the most value.

Organizations cannot scale AI without confidence in both the data powering it and the outputs it generates. This confidence depends on consistent governance, clear security policies, and visibility into how AI systems access and use enterprise data. In the AI era, zero trust must extend beyond users and devices to include data, models, AI agents, and automated systems. Organizations that consistently apply these principles across their AI ecosystem will be best positioned to innovate securely and scale AI with confidence.