2026年人工智能风险管理状况研究报告

90% Believe They Have Visibility.59% Have Shadow AI They Can't Govern.90% Believe They Have Visibility59% Have Shadow Al They Can't Govern. Published by The Purple Book Community, March 23, 2026Published by The Purple Book Community, March 23, 2026 Table of ContentsTable of Contents 92%92% 87% 86% feel their toolseffectively detectvulnerabilities.feel their toolseffectively detectvulnerabilities. of organizations
claim a complete AIinventory.of organizationsclaim a complete Alinventory. say they canconfidently identifytheir greatest
business risks.say they canconfdentlyidentifytheir greatestbusiness risks. 70%70% 59%59% 46%46% of organizationshave shadow AIthey can’t govern.of organizationshave shadow Althey can't govern. report AI-generated codevulnerabilitiesalready inproduction.report Al-generated codevulnerabilitiesalready inproduction. admit they wastesignificant time onvulnerabilities thatdon't matter.admit they wastesignifcant time onvulnerabilities thatdon't matter. The gap between what security leaders believe and whatthe data shows is what this report examines.The gap between what security leaders believe and whatthe data shows is what this report examines. Executive SummaryExecutive Summary AI has crossed the threshold from experimentation to enterprise standard, and security leaders believethey have it under control. The data suggests otherwise with 90% of organizations claiming full visibilityinto their AI footprint, while 59% simultaneously confirm shadow AI is present and ungoverned. If youcan see it, why can't you control it?Al has crossed the threshold from experimentation to enterprise standard, and security leaders believethey have it under control. The data suggests otherwise with 90% of organizations claiming full visibilityinto their Al footprint, while 59% simultaneously confrm shadow Al is present and ungoverned. If youcan see it, why can't you controlit? The Purple Book Community surveyed 650+ senior cybersecurity leaders across seven industries andtwo continents. The leaders in this survey are not junior practitioners or early-career managers. They areCISOs, VPs, Directors, and Security Architects with direct operational responsibility for enterprisesecurity programs. What they believe about their AI governance posture matters, and so does what thedata reveals about the gap between that belief and operational reality.The Purple Book Community surveyed 65O+ senior cybersecurity leaders across seven industries andCisOs, VPs, Directors, and Security Architects with direct operational responsibility for enterprisesecurity programs. What they believe about their Al governance posture matters, and so does what the What emerged is a portrait of confident governance layered over persistent, structural blind spots: apattern we call "The Confidence Gap."What emerged is a portrait of confident governance layered over persistent, structural blind spots: apatternwe call"The Confdence Gap." The ClaimThe Claim The numbers suggest a mature posture. 86% of security leaders claim to maintain a complete AIinventory. Nearly 90% believe they have visibility into AI data flows. And 83% say their existing securitytools effectively detect vulnerabilities in AI-generated code.The numbers suggest a mature posture. 86% of security leaders claim to maintain a complete Alinventory. Nearly 90% believe they have visibility into Al data flows. And 83% say their existing securitytools effectively detect vulnerabilities in Al-generated code. The RealityThe Reality The outcomes tell a different story. Nearly six in ten of those same leaders admit to the presence ofshadow AI. 70% report confirmed or suspected vulnerabilities introduced by AI-generated code. 73%admit the pace of AI-accelerated development has made it harder for security to keep up.shadow Al. 70% report confirmed or suspected vulnerabilities introduced by Al-generated code. 73%admit the pace of Al-accelerated development has made it harder for security to keep up. The cross-tabulations make the gap concrete. 57%of organizations that claim a complete AIinventory also admit shadow AI is present in their organization.The cross-tabulations make the gap concrete. 57% of organizations that claim a complete Alinventory also admit shadow Al is present in their organization. The code vulnerability data is equally striking. 92%of organizations with confirmed AI codevulnerabilities in production say their security tools effectively detect those vulnerabilities. If the toolswork, how are the vulnerabilities reaching production? If the inventory is complete, where is the shadowAI coming from?The code vulnerability data is equally striking. 92% of organizations with confrmed Al codevulnerabilities in production say their security tools effectively detect those vulnerabilities. If the toolsAl coming from? The ConsequenceThe Consequence Security leaders aren't lacking awareness. They're lacking the ability to convert that awareness intogover