On July 29, 2026, Kiteworks published the 2026 Data Security and Compliance Risk: Annual Survey Report, a survey of 459 security, compliance, and IT leaders across 10 industries and three regions. The finding that mattered most: no AI containment control measured in the survey, not a kill switch, not behavioral monitoring, not purpose binding, was deployed by more than 31% of organizations. Eighty percent of respondents had already been hit by a security or AI-related incident in the prior 12 months.
Three days later, Black Hat USA’s Trainings opened at Mandalay Bay. Three days after that, Ai4 opened across town at The Venetian. Whether or not conference organizers had seen the report, the overlap was hard to miss. Over the following week, both spent their keynotes, their vendor announcements, and their own attendee surveys proving it live, one disclosure at a time.
That’s the frame for what follows: 15 takeaways from two conferences that ran on overlapping days in Las Vegas, read alongside the survey that predicted, almost to the point of coincidence, what both of them would find.
What the report already knew
The Annual Survey Report scores organizations on two composite measures instead of asking how confident they feel. The Data Security Maturity Score (DSMS) tracks 11 operational security controls; the survey mean came in at 39 out of 100. The AI Governance Maturity Score (AIGMS) tracks 19 AI-specific governance capabilities; the survey mean was 35 out of 100. Multiply the two together and you get the Data Security and Compliance Readiness Index (DSCRI), a single number meant to capture whether security maturity and AI governance are actually advancing together. The survey mean DSCRI is 16.2 out of 100. Only 7% of organizations reached the top security tier; only 9% reached the top AI governance tier.
The report is itself an accountability check on an earlier one. In December 2025, Kiteworks Data Security and Compliance Risk: 2026 Forecast Report projected that purpose-binding gaps would sit near 63% and kill-switch gaps near 60% by the middle of 2026, with both narrowing modestly as containment pipelines matured. The Annual Survey Report found purpose binding absent at 74% and kill-switch capability absent at 79%. The gap didn’t narrow. It widened. Everything Black Hat and Ai4 put on stage the following week was, in effect, a live cross-examination of that trend line.
What Black Hat’s research track confirmed
- The AI attack surface moved from the model to the hardware underneath it. In a notable shift, marquee research targeted the infrastructure running AI workloads rather than prompts or outputs. University of Toronto researchers presented GPUBreach, a Rowhammer attack against NVIDIA GDDR6 memory that escalates an unprivileged CUDA process to a full host root shell. It does this with IOMMU enabled, the one protection every prior GPU Rowhammer exploit needed disabled to work. Shared cloud GPU instances running AI training and inference are the direct target, which means the exposure sits underneath every AI governance policy an enterprise has written, not inside it.
- Even “secure” source code isn’t safe from its own compiler. A separate Black Hat briefing, “C and Its Consequences,” showed how compiler optimization passes can silently reintroduce race conditions that developers believed they had already fixed in source. It’s a quiet but important point for anyone betting AI-driven code review will catch what human review missed: the vulnerability may not exist until the compiler puts it there, which means no amount of AI-assisted static analysis on the source file will find it.
- Washington showed up to Black Hat in a way it never has before. The opening keynote paired White House National Cyber Director Sean Cairncross with the acting director of CISA, the FBI’s Cyber Division chief, and the Department of War’s principal cyber advisor. It was an unusually senior concentration of US civilian cyber leadership on the Black Hat stage, and the subject was AI’s effect on offensive and defensive cyber operations. Government isn’t just watching this fight anymore, and a conference built for practitioners is now also where policy gets road-tested in front of the people who have to implement it.
- Every major security vendor shipped an “agent governance” product this year. Scan the week’s announcements and a pattern jumps out: identity vendors building controls for non-human identities, SOC platforms adding agent-specific detection, endpoint tools built to police coding agents like Claude Code and Cursor. The industry has stopped treating AI agents as a feature and started treating them as an identity class that needs the same governance humans get. Right now, that class has almost none, which is exactly the gap the Annual Survey Report put a number on before a single vendor booth opened: 26% purpose binding deployed, 21% with a working kill switch, 28% with AI-specific DLP. Vendors spent the week selling the other 70-plus percent.
- Identity research keeps landing on the same root cause, agent or human. BeyondTrust’s Phantom Labs offensive research team published its first annual index this week: of more than 400 research efforts over the past year, 75% traced back to an identity or privilege gap in some form. AI and LLM security was the single largest category the team studied, 180 of those 400-plus projects, because, as the team put it, AI agents authenticate, invoke tools, and inherit permissions exactly like any other identity. They just get far less scrutiny. That’s an independent confirmation, from an offensive research team with no relationship to Kiteworks, of the same finding the survey reported from the defensive side: the identity infrastructure for agents exists on paper far more often than it exists in enforced, technical form.
- Exploitation windows have collapsed to hours, and AI is a big reason why. CrowdStrike’s 2026 Threat Hunting Report, tracking more than 290 named adversary groups, found that 88% of vulnerabilities with a public proof-of-concept were exploited within 48 hours of release during the first half of 2026. Some nation-state groups moved in under 24 hours. Patch cycles built around weekly or monthly cadences were never designed for this, and neither was the audit process most organizations still run: the Annual Survey Report found only 27% of organizations can produce a complete AI data access audit record within one business day, and just 17% within one hour.
- AI’s own supply chain is now a battlefield. The same CrowdStrike report documented a DPRK-linked group injecting a malicious npm package into 131 trusted AI framework packages tied to the Mastra ecosystem, a direct compromise of the tooling developers use to build AI agents in the first place. Adversaries aren’t just attacking AI. They’re attacking the pipeline that ships it, which is a harder problem than a compromised endpoint because the trust boundary sits inside the developer’s own build process.
- Hackers aren’t jailbreaking models. They’re just asking nicely. Cisco Talos studied prompt logs and coding sessions that threat actors accidentally exposed online, running through Claude Code, Codex, Cursor, and Gemini. The bypasses weren’t sophisticated. Actors split malicious work across sessions so no single request looked harmful, or simply told the model they were doing authorized security research. In one case, a moderately skilled actor used an AI-assisted pipeline to turn a public vulnerability writeup into an automated credential harvester, scanning more than 9,000 internet-exposed hosts. Guardrails built to catch intent aren’t built to catch persistence, and it tracks with something the survey found on the enterprise side of the same coin: 65% of organizations discovered employees using unapproved AI tools with sensitive company data in the past year. Ungoverned use isn’t just an outside-in problem. It’s inside-out too.
What Ai4’s agenda confirmed
- The industry’s own founders are now arguing about this in public, on purpose. Ai4 put Geoffrey Hinton, Fei-Fei Li, and Andrew Ng on the same stage for the first time. Organizers undersold it by calling it “star power.” Hinton has put real numbers on existential risk from AI; Ng has testified to the US Senate that he sees no credible path to it and that the rhetoric itself does harm. Programming that disagreement directly, rather than smoothing it into a panel consensus, is itself a signal: the debate is mainstream enough now to be the headline act rather than the thing conferences avoid.
- Ai4’s own agenda shifted from “what agents can do” to “what happens when they’re wrong.” Compare this year’s track list with last year’s. The largest cluster of sessions in 2026 covers production deployment, governance, and failure modes, not agent concepts. The addition of a standing #AIFails track, where practitioners present documented deployments that went sideways, is the tell. Enterprises have moved past the demo stage, and now they’re comparing notes on what breaks, which is a more honest posture than most vendor keynotes allow and closer to what the survey data actually shows: 64% of organizations have already deployed AI into production or are actively using external AI platforms, and among that group, 70% are running three or more distinct AI use cases simultaneously. The failures Ai4’s new track is built to document aren’t hypothetical. They’re already running in production, at scale, in most of the room.
- Compliance deadlines, not white papers, drove the policy conversation. Ai4’s AI Policy Summit ran the same week the EU AI Act’s most substantive provisions took effect, alongside new US export controls on frontier models and a wave of state-level AI legislation moving in parallel. For once, a conference policy track wasn’t theoretical. The clock was already running when attendees walked into the room, and the survey put a number on the consequence side of that clock: 63% of organizations experienced a compliance outcome in the past year tied to AI or data risk, ranging from an audit finding to a formal regulatory investigation.
- The agent-authorization problem showed up in every serious session, no matter the track. Whether the speaker was from Cisco, OpenAI, or a hospital system, the operational question kept repeating: what can this specific agent see, touch, and act on, and who finds out when it goes past that. Ai4 didn’t invent that question. It’s the same one running through Black Hat’s vendor floor and BeyondTrust’s research index, and it’s the same one the Annual Survey Report answered with a number two months before either conference opened: 74% of organizations have no purpose binding on their AI agents at all. Two very different audiences landed on the same worry without knowing it, and a survey published in July had already told them why.
More must-read AI coverage
- SS&C Intralinks DealCentre AI vs. Datasite: Which platform is built for the future of dealmaking?
- SS&C Intralinks FundCentre AI vs. Juniper Square: Which platform better supports modern private markets fund managers?
- Why Data, Not Models, Determines AI Success
- The Rise of the AI-Native Factory: How Physical AI Is Transforming Manufacturing
What showed up on the floor
- Attendees wanted to feel the failure, not just hear about it. A Kiteworks colleague, Craig Pfister, drew a packed room at Ai4 with a session on a narrower version of the same problem: how organizations control what data an AI agent can access and use, rather than just writing a policy about it and hoping the agent complies. Down the aisle, the line for Kiteworks’ own interactive VR experience, Evil Breach 2, told the same story. Security leaders wanted to walk through what an ungoverned agent breach looks like before they went home and tried to prevent one. The Kiteworks Annual Survey Report is the reason that session and that VR line existed in the first place: it gave the room a number for the thing they already suspected, and a lot of people wanted to see the number acted out in real time.
- The gap both shows spent the week reacting to was already published. The Annual Survey Report found that 74% of organizations have not applied purpose binding to their AI agents, meaning those agents are not technically restricted to the tasks and data scopes they were authorized for. It’s the same gap Black Hat’s vendors spent the week selling controls for, the same gap Ai4’s #AIFails track was built to document, and the same gap that widened, not narrowed, from what the Forecast Report projected eight months earlier. Every session and every product launch discussed above is downstream of that one statistic.
- Deployment is outrunning containment everywhere anyone measured it. The survey also found that 80% of organizations experienced at least one security or AI-related incident in the past 12 months, not a projected risk but a reported outcome. Put that next to CrowdStrike’s hours-long exploitation windows and BeyondTrust’s identity-rooted findings, and a pattern emerges that neither conference stated outright but both proved from opposite directions: organizations have gotten very good at deploying AI and very behind on the four or five controls that would contain it when something goes wrong.
The pattern underneath all 15
I’ve sat through a lot of these Las Vegas weeks. I can’t remember another one where a survey published in July, a GPU exploit disclosed in August, and a Senate testimony from earlier this year turned out to be describing the same failure from three different angles. None of this is really 15 separate problems. It’s one problem showing up in a vulnerability disclosure, a keynote panel, a threat-hunting report, and a trade-show survey, all in the same stretch of weeks. Enterprises are extending access, tool use, and decision authority to AI agents at a pace that has outrun the infrastructure to govern them. Every data point above, whether it came from a GPU exploit or a compliance survey published before either conference had a chance to open, is measuring the same gap from a different angle.
Closing it requires the same architecture for agents that mature organizations already apply to people: access bound to purpose, activity logged and auditable, and a technical kill switch that doesn’t depend on the agent’s cooperation to work. Human governance and agent governance can’t be two separate programs anymore. They’re the same program, or neither one holds. The organizations with a DSCRI north of 70 in the survey, and there were only a handful, got there by building that architecture before they needed it, not after an incident forced the question.
AI agents aren’t especially hard to govern. Most organizations just don’t know yet how ungoverned theirs already are, and now there’s a number for it, published before either conference even started.
Tim Freestone is the Chief Strategy Officer at Kiteworks, where he focuses on data security, compliance, and AI governance strategy across regulated industries.