Wavestone AI Cyber Benchmark 2026 Finds Governance Ahead of Operational Security

Wavestone has published a 2026 benchmark with a clear conflict: organizations govern AI far better than they secure it after deployment. The Wavestone AI Cyber Benchmark 2026 found governance mechanisms at 88% of its panel. Yet only 8% connect AI application logs to security operations center monitoring.

That gap matters because organizations are assuming more responsibility for their AI systems. Half of the assessed organizations now design systems with existing frameworks or pretrained models, up from 35% in 2025. Another 40% manage the entire development chain.

The benchmark therefore measures more than progress in policy writing. It captures a transfer of operational risk from technology providers toward enterprise engineering, security, data, and business teams. Those teams now own systems that can retrieve sensitive information, call tools, and take actions.

Wavestone’s central finding is uncomfortable. Governance can authorize an AI system, but authorization does not make that system observable, recoverable, or safe during an incident. The organizations moving fastest into custom models and agentic workflows face the largest version of this problem.

The Wavestone AI Cyber Benchmark 2026 Exposes a Wide Control Gap

Organizations have established AI governance faster than the operational controls needed to contain failures, investigate incidents, and restore trusted systems.

Wavestone published the benchmark on September 14, 2026. Its panel covers 30 large public and private organizations. The assessment also incorporates observations from the consultancy’s AI security work during the previous three years.

The framework uses five functions adapted from the NIST Cybersecurity Framework. Each function contains more than 30 assessment questions, scored across a maturity scale from zero to 100%.

The results decline as the functions move closer to live security operations:

• Govern scored 54%.

• Identify scored 55%.

• Protect scored 48%.

• Detect scored 40%.

• Respond scored 29%.

The highest score concerns identifying risk, while the lowest concerns responding when risk becomes an actual event. This distribution supports Wavestone partner Gérôme Billois’s conclusion: organizations are better at governing AI than operating it securely in production.

The detailed results make that contrast sharper. According to the 2026 benchmark, 88% of the panel had implemented AI governance mechanisms. However, only 32% had clearly defined activities, stakeholders, and accountability models.

This distinction separates a policy from an operating model. A policy can require security reviews without identifying who monitors an approved system. It can mandate escalation without establishing who investigates a compromised knowledge base.

The skills picture remains similarly uneven. Only 44% of the organizations identified dedicated AI security experts who could support technical and business teams throughout the system lifecycle.

Organizations have made more progress in testing. Two-thirds perform dedicated AI security penetration testing, while half conduct advanced AI-focused assessments. Fifty percent include AI assessments in recurring audit and penetration-testing programs.

Still, a test captures a system at a particular moment. Models, retrieval sources, permissions, integrations, and user behavior change after deployment. A passing assessment cannot replace continuous visibility into those changes.

The benchmark’s methodology also requires caution. Its percentages describe 30 assessed organizations, not the entire global market. Wavestone explicitly warns against reading the panel as a representative market estimate.

Even with that limitation, the internal pattern is meaningful. Controls associated with approval and assessment are much more common than controls associated with detection, investigation, and recovery. That is the benchmark’s real news.

Companies Are Moving From AI Consumption to AI Ownership

The security gap becomes more consequential as enterprises build more of the AI stack and inherit responsibilities previously handled by providers.

In 2025, 30% of Wavestone’s panel only used AI features supplied through existing products. That share fell to 10% in 2026. The change signals a decisive movement beyond passive consumption.

Half of the 2026 panel designs AI systems internally with existing frameworks or pretrained models. That proportion increased from 35% one year earlier. Organizations managing the complete development chain rose from 35% to 40%.

Those categories carry different security obligations. A company consuming an AI feature mainly manages data exposure, user access, configuration, and supplier risk. An organization building a retrieval system must also secure its data pipeline, vector database, model connections, and application logic.

A vector database stores mathematical representations used to retrieve relevant information for an AI response. If attackers manipulate that store, the system can retrieve poisoned material without compromising the underlying model.

The ownership problem extends to knowledge repositories. Organizations often treat internal documents as governed business information, but not as active components of an AI attack surface. Retrieval changes that assumption because stored information can directly influence system behavior.

Wavestone found that 72% of the panel had started implementing privacy measures for AI training. Sixty-five percent performed dataset quality checks. Only 9% systematically evaluated both dataset quality and security before production.

Quality checks ask whether data is accurate, complete, and suitable for a task. Security checks ask whether the data was manipulated, exposed, or obtained through an unauthorized path. One process cannot substitute for the other.

Provider controls offer another example. Cloud and model platforms supply authentication, logging, filters, and configuration safeguards. Yet those protections cover only the responsibilities retained by the provider.

Only 11% of Wavestone’s panel had begun evaluating or implementing safeguards beyond provider-native controls. That becomes a larger concern when teams fine-tune models, self-host components, or connect agents to internal tools.

The benchmark does not argue that organizations should avoid internal development. Building systems can improve control over architecture, data location, and dependencies. It also makes the organization accountable for securing each added component.

Wavestone’s 2025 findings already pointed toward this issue. They distinguished AI users from organizations orchestrating third-party models and advanced builders creating proprietary systems.

The 2026 results show that more organizations have entered the demanding categories. Their security programs have not advanced evenly with that transition.

This is why operational AI security now creates pressure across several teams. Engineering must produce usable telemetry. Security operations must interpret it. Identity teams must constrain permissions, while business owners must decide what agents may do.

Documentation and searchable operational knowledge also become important during this transition. Teams need current ownership records, system dependencies, decisions, and response procedures. A maintained searchable knowledge base can support that work, although it cannot replace security controls.

AI Security Governance Is Not the Same as Production Control

The main contest is between documented governance and continuously enforced control, not between organizations with and without AI policies.

Governance creates necessary boundaries. It can define acceptable use, classify system criticality, assign review requirements, and establish escalation paths. Those foundations are valuable, but they do not automatically operate the system.

Operational control asks different questions. Can the organization see suspicious behavior? Can it isolate an agent? Can investigators reconstruct what happened? Can teams restore a trusted model, dataset, or knowledge repository?

The Wavestone AI Cyber Benchmark 2026 found that 88% of organizations collect AI application logs. Only 8% route those logs into security operations center monitoring.

This is not primarily a data-collection failure. It is an integration failure between AI operations and security operations.

AI application teams commonly monitor latency, cost, output quality, failed requests, and model performance. Security teams search for compromised identities, abnormal access, malicious inputs, data extraction, and unauthorized changes.

The same event can look different to each group. A surge in tool calls might indicate a popular workflow, a defective agent loop, or an attack. Useful detection requires context from both the application and the security environment.

Logging also needs a defined purpose. Collecting prompts without access events, tool invocations, model versions, retrieval sources, or authorization decisions can leave investigators with an incomplete record.

NIST’s AI RMF Core treats post-deployment monitoring, incident response, recovery, and change management as connected outcomes. It also calls for documented processes to track and recover from incidents and errors.

That lifecycle approach conflicts with one-time approval. An AI system can change without a conventional software release. A provider may update a model, a team may replace a retrieval source, or administrators may expand an agent’s permissions.

These changes can invalidate earlier assumptions. A review that approved read-only document retrieval says little about a later workflow that can edit records or send messages.

The same problem affects testing. Two-thirds of Wavestone’s panel conduct dedicated AI security penetration tests. However, the benchmark argues that mature organizations must make testing recurring rather than exceptional.

Recurring testing should follow material changes. Those changes include new models, tools, datasets, fine-tuning, access scopes, and autonomous steps. The testing program also needs coverage across the organization’s AI portfolio.

Automated scanning can find vulnerable components and configuration errors. It cannot fully reproduce adversarial interactions involving ambiguous instructions, poisoned context, or several connected tools.

AI red teaming addresses those interactions through structured adversarial testing. Yet even red teaming supplies evidence about tested conditions, not a permanent guarantee. Monitoring and response must handle the behaviors that testing misses.

The gap between governance and operations therefore reflects different work. Governance decides what should happen. Operational security detects when reality departs from that decision and gives teams a way to intervene.

Agentic AI Turns Weak Identity Controls Into Business Risk

An AI agent with excessive access can convert a misleading input or model error into an unauthorized business action.

Agentic AI refers to systems that plan tasks, call tools, and perform actions with limited human direction. This capability changes the security objective from controlling generated text to controlling authorized behavior.

Thirty-three percent of Wavestone’s panel had incorporated agentic AI risk into governance frameworks. Only 17% included secure access to AI functions and tools in development standards.

The implementation rate falls further for identity controls. Just 15% had dedicated identity and access management safeguards for AI systems and agents.

That gap matters because agents connect probabilistic model decisions with deterministic enterprise systems. A model may select an action from uncertain context, but the downstream database or workflow executes that action concretely.

The risk does not require a malicious model. A manipulated document, indirect prompt injection, ambiguous request, or faulty planning step can redirect an otherwise legitimate agent.

OWASP describes excessive agency as damaging behavior enabled by excessive functionality, permissions, or autonomy. Its guidance recommends narrow tools, minimum permissions, downstream authorization, and activity monitoring.

These controls place enforcement outside the model. That design choice is important because asking a model to police its own permissions creates a circular dependency.

Consider an internal research agent that reads files and prepares summaries. It needs access to approved repositories, but it probably does not need deletion rights. Its file connector should expose only the necessary operations.

A customer-service agent presents a different risk. It might read account information, issue credits, and modify service settings. Each action needs a defined limit, authorization check, and audit record.

A software agent may interact with source code, issue trackers, deployment systems, and cloud infrastructure. Using one privileged identity across those systems makes attribution difficult and increases the possible impact of one failure.

Least privilege limits every agent to the smallest required set of resources and actions. Short-lived credentials reduce exposure time. Per-agent identities make activity easier to trace.

High-impact actions may also need human approval. The control should apply before execution, not after the model has already changed a critical system.

Wavestone emphasizes that agent actions should remain bounded, traceable, and interruptible. Interruption requires more than a user interface stop button. Security teams need a reliable way to revoke credentials and block downstream access.

The AI Controls Matrix offers a broader control framework for cloud-based AI systems. Its 2026 edition includes 247 objectives across 18 security domains.

Framework availability is not the main constraint, however. The benchmark shows that organizations already recognize many risks at the governance level. Implementation inside application architecture and security operations remains the harder task.

Agentic AI makes that implementation urgent. A chatbot with weak controls can disclose information or produce a harmful answer. An agent with weak controls can also act on that answer.

Incident Response and Recovery Remain the Weakest Links

Organizations cannot claim operational resilience when most lack AI-specific investigations, response plans, and standardized recovery practices.

The Wavestone benchmark gives Respond the lowest maturity score, at 29%. Its supporting measures show why.

Only 8% of assessed organizations could perform forensic investigations on AI platforms. AI forensics involves reconstructing relevant prompts, retrieved content, tool activity, model versions, permissions, and system changes.

Half of the panel still used ad hoc remediation without a structured response process. Only 13% had documented AI-specific incident response plans, and Wavestone says those plans were not consistently applied.

Recovery was also limited. Twenty-two percent backed up AI-related assets, with largely nonstandardized practices.

A traditional application backup may preserve code and databases. An AI service can depend on additional assets, including model configurations, fine-tuning data, embeddings, safety policies, prompts, and external knowledge sources.

Restoring availability does not establish trust. A recovered knowledge repository may still contain poisoned documents. A restored agent may retain compromised credentials or unsafe permissions.

The first response challenge is classification. Teams must distinguish security events from reliability failures, policy violations, model errors, and ordinary user mistakes. Some incidents cross several categories.

An unauthorized agent action could begin with prompt injection, expose data, and create incorrect records. Responders may need security, privacy, legal, engineering, model-risk, and business expertise.

The second challenge is evidence. Investigators need synchronized records across model services, identity systems, retrieval components, tool gateways, and target applications. Missing context can prevent reconstruction.

Wavestone’s 88% logging figure can therefore look more reassuring than it is. Logging only helps response when teams preserve the right events, correlate them, and make them available to investigators.

The third challenge is containment. Organizations must know how to disable an agent, revoke its credentials, quarantine a dataset, switch models, or suspend a connected tool without causing wider disruption.

The fourth challenge is recovery. Teams need a known-good state and an integrity test before returning the system to service. Otherwise, recovery can restore the same vulnerability or compromised information.

This operational complexity explains why response maturity trails governance. Policies can often extend existing risk-management structures. AI incident response requires new technical evidence, cross-team procedures, and exercises.

The benchmark’s small panel remains an important limitation. These percentages should not become claims about every large enterprise. Organizations that volunteered for detailed assessments may also differ from the wider market.

Measurement changed as well. Wavestone expanded its 2026 assessment to include agent security, specialized protections, monitoring, and response. Direct year-over-year comparisons should therefore focus on clearly matched measures.

Still, the pattern aligns with established risk guidance. NIST’s generative AI profile emphasizes incident documentation, logging, reporting, and lifecycle information sharing.

The skeptical interpretation is not that governance has failed. It is that governance maturity can create false confidence when operational evidence remains thin.

A policy may satisfy an internal milestone. It does not show that a security team can detect compromised retrieval, trace an agent’s actions, or restore a trustworthy system.

Three Signals Will Show Whether Operations Catch Up

The next phase of AI security maturity will be measured through connected telemetry, enforceable agent permissions, and rehearsed recovery.

The first signal is the percentage of organizations feeding AI events into active security monitoring. Wavestone found an 80-point gap between collecting application logs and integrating them into SOC monitoring.

Closing that gap requires defined detection cases, not simply forwarding every record. Teams should identify events that indicate suspicious retrieval, permission escalation, unusual tool use, or attempted data extraction.

Evidence of improvement would include tested alerts, investigation playbooks, and shared ownership between AI and SOC teams. Another policy document would not resolve the operational gap.

The second signal is the adoption of dedicated identity controls for agents. The current 15% result shows that governance recognition has moved ahead of technical enforcement.

Progress should appear through distinct agent identities, narrowly scoped access, short-lived credentials, and authorization inside downstream services. High-impact actions should have explicit approval requirements.

This signal will become more important as organizations introduce agents into finance, customer operations, software delivery, and internal knowledge workflows. Each additional tool expands the consequences of excessive access.

The third signal is whether organizations exercise AI-specific incident recovery. A written plan is useful, but teams must test containment, investigation, restoration, and integrity validation.

Exercises should cover compromised datasets, poisoned knowledge sources, leaked credentials, unsafe model changes, and unauthorized agent actions. They should also test whether the organization can continue critical work during containment.

These signals will either strengthen or weaken Wavestone’s central judgment. Higher monitoring integration would show governance moving into operations. Better identity controls would show that agent policies are becoming enforceable.

Successful recovery exercises would provide the strongest evidence. They would show that organizations can maintain control when prevention fails, rather than assuming every safeguard will work.

The Wavestone AI Cyber Benchmark 2026 presents a tradeoff that enterprise leaders cannot solve through slower adoption alone. More internal development can improve autonomy and architectural control, but it also transfers responsibility inward.

Security leaders should ask for evidence behind every governance milestone. Which systems send actionable events to the SOC? Which agent permissions can be revoked immediately? Which AI assets have tested recovery procedures?

Engineering and business owners should ask parallel questions. Who owns each deployed system after approval? What changes trigger reassessment? Which human can stop an autonomous action before it reaches a critical application?

The decisive question is no longer whether an organization has an AI policy. It is whether that organization can detect, contain, investigate, and recover when an AI system behaves outside expectations.