Kiteworks has released its 2026 Data Security and Compliance Risk: Annual Survey Report, finding that 80% of organizations experienced at least one security or AI-related incident during the past 12 months.

The report is based on primary research with security, compliance, risk and IT professionals across 10 industries and three global regions. Now in its fifth year, the survey found that 63% of organizations experienced a compliance outcome following those incidents, including audit findings, remediation plans, board escalations, contractual penalties or formal regulatory investigations. It also found that 65% discovered employees using unapproved AI tools with sensitive organizational data.

Unlike surveys based on self-reported confidence, the report evaluates organizations using deployed technical controls. The Data Security Maturity Score (DSMS) measures 11 binary security controls, including eight general controls and three AI-specific controls. The AI Governance Maturity Score (AIGMS) evaluates 19 AI and agent governance capabilities.

The survey found an average DSMS of 39 out of 100, an average AIGMS of 35 out of 100 and a combined Data Security and Compliance Readiness Index (DSCRI) of 16.2 out of 100. According to the report, 70% of organizations fall into Tier 1 or Tier 2 maturity.

"Organizations have deployed AI far faster than they've built the governance infrastructure to manage it," said Tim Freestone, Chief Strategy Officer at Kiteworks. "The incidents have already happened, and the compliance consequences are already being felt. The path forward is architectural. It requires a data policy engine that enforces controls at the data layer for every person and every agent alike, not behavioral policy people can route around. Organizations that reached Tier 4 maturity got there by deploying controls, not documenting intent."

The report also identified significant governance gaps. No AI containment control surveyed has been deployed by more than 31% of organizations. Half of respondents said they could not produce a complete AI data access audit record within one business day. Additionally, 73% reported having no technical enforcement over which channels employees can use for sensitive data while only 27% had deployed AI-specific data loss prevention.

Among organizations that detected employees using unapproved AI tools, 36% found customer and client data being shared through those tools, 33% identified IT credentials and 31% found employee personal and HR data. Kiteworks noted that the 35% of organizations reporting no discovery may lack the detection capabilities needed to identify such activity.

"AI risk is no longer a future problem. It is a present condition most organizations are still treating as a planning exercise," said Patrick Spencer, SVP of Americas Marketing and Industry Research at Kiteworks. "Organizations still waiting to act are behind, not ahead. This research gives leaders defensible data grounded in deployed controls, not stated intentions, the foundation for moving investment toward architecture that governs people and agents under one standard."

The report found a 38-point gap in DSCRI scores between organizations in its highest and lowest maturity groupings. Organizations classified in the "Resilient" quadrant, representing 19% of respondents, achieved an average DSCRI of 46. By comparison, the 66% of organizations in the "Exposed" quadrant averaged a DSCRI of 8.

Kiteworks identified seven priorities for improving AI governance and data security readiness:

• Classify and enforce sensitive data
• Deploy AI-specific data loss prevention through a centralized policy engine
• Integrate managed file transfer and AI infrastructure with a SIEM
• Implement and test an AI kill switch
• Build audit trails that meet regulatory production timelines
• Assign dedicated AI data governance ownership
• Consolidate sensitive data exchange platforms

The report also includes industry, regional and organization-size breakdowns along with a Security Maturity Readiness Checklist intended to help organizations prioritize remediation investments.