The AI Adoption Gap Nobody Wants to Talk About: Why the Threat Landscape Has Permanently Changed

Almost every organisation using AI today has a strategy for adopting it. Far fewer have a strategy for governing it. That gap — between how fast AI is moving into businesses and how slowly the oversight structures are following — is not a theoretical risk. It is the operational reality that made the most serious AI security incidents of 2026 possible. And it is widening.

In this first part, we lay out the diagnosis: the data behind the governance gap, the structural shifts in the threat landscape, and why the risks introduced by AI adoption are categorically different from the ones most businesses think they are managing.

---

The Number That Should Worry Every Business Leader

Here is a statistic that deserves more attention than it gets. According to the 2026 State of AI Cybersecurity report, 77% of organisations now run generative AI in their security stack. But only 37% have a formal AI policy in place. That means the majority of organisations are deploying AI in sensitive environments without having decided, documented, or communicated what the rules around it actually are.

It gets worse. That 37% figure is down from 45% the previous year. In the year AI adoption exploded fastest, governance coverage shrank.

Cyberhaven's 2026 AI Adoption and Risk Report, built on data from 222 companies and billions of real-world data movements, found that 39.7% of all AI interactions now involve sensitive data. The average employee inputs proprietary information into an AI tool once every three days. Nearly 30% of organisations have no formal AI governance policy at all, despite AI tools being pervasive across their networks.

Deloitte's State of AI 2026 adds the sharpest dimension: nearly three-quarters of organisations plan to deploy autonomous AI agents within the next two years. Yet only 21% report having proper governance in place for them. The organisations racing to deploy agentic AI are, in the majority of cases, doing so without the governance infrastructure to manage what those agents can access, what they can do, and what happens when something goes wrong.

Governance readiness in enterprise AI sits at 30%. Talent readiness sits at 20%. Adoption is racing ahead. The infrastructure built to support it is not keeping up — and the gap between the two is where attackers are building their campaigns.

These numbers do not describe a future risk. They describe the conditions that existed when the LiteLLM supply chain attack landed in March 2026, when the CareCloud breach went undetected for eight hours, and when thousands of developer machines were silently harvested of credentials while their owners thought they were running a routine dependency update. (We covered both incidents in detail here.)

---

What Has Structurally Changed About the Threat Landscape

The phrase "evolving threat landscape" has appeared in so many security reports that it has almost lost meaning. But something genuinely structural has shifted in the AI era, and understanding what it is matters more than cataloguing individual incidents.

In the pre-AI enterprise, the threat model was relatively containable. Known systems, auditable credentials, scopable permissions, and a clear distinction between the tools people used and the data those tools could reach. Security teams knew the perimeter. They debated how to defend it. They invested in the boundary.

That model has fractured — not gradually, but sharply, over the past 18 to 24 months. Three things happened simultaneously that changed the nature of the problem.

AI infrastructure became a concentration point for high-value access

Tools like LiteLLM, which sits between applications and every LLM API call, routinely hold or have access to authentication credentials across dozens of AI services simultaneously. Compromise one library, and you do not steal one credential. You harvest the keys to every AI service an organisation is running. Attackers have understood this. The TeamPCP campaign that backdoored LiteLLM in March 2026 was not opportunistic — it was a deliberate escalation through the most trusted and access-concentrated tools in the AI developer stack.

The software supply chain became an attack surface of its own

The TeamPCP campaign did not start with LiteLLM. It started with a security scanner, moved to a CI/CD tool, and arrived at the AI proxy through a chain of compromised trust relationships — each step using the legitimate access of the previous one. No individual step was obviously suspicious. The chain as a whole was devastating. The perimeter, in that model, is not a boundary you defend. It is a trust chain you audit.

The explosion of AI tooling outpaced any organisation's ability to audit it

The top 1% of AI-adopting enterprises now use over 300 generative AI tools. McKinsey's 2026 AI Trust Maturity Survey found that only 30% of organisations have reached a meaningful maturity level in agentic AI governance controls. The tools are in production. The controls are not.

The threat landscape has not just gotten worse. It has changed in kind. The attack surface is now the AI stack itself — the dependencies, the pipelines, the credential flows, and the agent permissions. And most organisations have no map of it.

---

The Supply Chain Is the New Perimeter

Traditional security thinking was organised around the idea of a perimeter: protect the boundary, and what is inside is relatively safe. That model eroded as cloud adoption, remote work, and SaaS proliferation made the boundary harder to define. In the AI era, it has effectively dissolved.

The software supply chain — every open-source package, every third-party library, every GitHub Action, every CI/CD tool, every npm or PyPI package pulled by something your team installed — is now part of your attack surface. And because AI development stacks are particularly dependency-heavy, and because the AI ecosystem moves at an unusual speed with unusually high implicit trust in popular packages, that surface is disproportionately large and poorly understood.

The transitive dependency problem

Most organisations have some process for reviewing direct dependencies — the packages they consciously choose to install. Almost none have systematic visibility into transitive dependencies: the packages their packages install. Research consistently shows that over 74% of malicious packages reach production through this transitive path. Many of the teams affected by the LiteLLM attack had never consciously decided to use LiteLLM at all. It arrived in their environments as a dependency of another tool they were running.

CI/CD pipelines as credential vaults

The LiteLLM attack succeeded because its CI/CD pipeline held a PyPI publishing token that was accessible after a prior compromise of an upstream tool. CI/CD pipelines routinely hold publishing credentials, cloud access keys, deployment tokens, and API keys. They are treated as automation infrastructure. They should be treated as privileged access systems with the same scrutiny applied to production databases.

The mutable release reference problem

Part of what made the Trivy attack possible was that release tags in GitHub Actions are mutable by default. An attacker who compromises a repository can rewrite tags to point to malicious commits, and any pipeline referencing those tags will pull the compromised version on its next run — without any visible change to the pipeline configuration itself. Pinning to specific commit hashes and verifying those hashes is the architectural response. Most pipelines are not configured this way.

---

Agentic AI: The Attack Surface That Did Not Exist Three Years Ago

There is a category of risk that has emerged from AI adoption that traditional security frameworks were not designed to address: the risk introduced by AI agents — systems that operate autonomously, read files, execute commands, call APIs, browse the web, write to databases, and take actions on behalf of users without step-by-step human instruction.

Three years ago, this was a research topic. Today, it is production infrastructure. 79% of enterprises have adopted AI agents in some form. The agentic AI market is projected to grow from $8.5 billion in 2026 to $35 billion by 2030. And yet 88% of AI agents fail to reach production — not because the technology does not work, but because the governance, infrastructure, and evaluation frameworks needed to deploy them responsibly are not in place.

The new questions traditional security does not answer

The security questions governing the pre-AI enterprise — who has access, what credentials do they hold, are perimeters intact — are necessary but no longer sufficient. Agentic AI introduces questions that most frameworks have not yet incorporated:

• What can our AI agents actually do — not what we intend, but what they are technically capable of, given the permissions they hold?
• What data can they access? Can they reach production databases, customer records, or credential stores?
• What can they transmit? Can they make arbitrary outbound network calls? To which domains, with what content?
• What happens if an agent is manipulated through its inputs? Prompt injection — where malicious content in processed files causes an agent to take unintended actions — is a live threat with no close analogue in traditional software security.
• Who is accountable when an agent causes harm? If an AI agent results in data exposure or regulatory breach, is there a named owner, a response plan, and a way to roll it back?

Organisations can no longer concern themselves only with AI systems saying the wrong thing. They must also contend with systems doing the wrong thing — taking unintended actions, misusing tools, or operating beyond appropriate guardrails. — McKinsey 2026 AI Trust Survey

---

The Pace of Adoption Is Outrunning Governance — and the Data Proves It

Auvik's 2026 IT Trends Report identified what it called a "maturity mirage": organisations believe they are more prepared for AI than they actually are. Three-quarters of IT leaders say their organisation has an AI policy. Fewer than half of the help desk staff say the same. That is not a policy gap. It is an implementation gap — the difference between a document that exists and a standard that is understood and followed throughout the organisation.

The Cyberhaven data adds operational texture. In leading organisations, 71.4% of employees use generative AI. In cautious enterprises, that figure drops to 2.5%. The gap between these groups is widening, not closing. And the organisations in the fast-moving group are, on average, the ones with the least mature governance and the least visibility into what their AI tools are actually doing with sensitive data.

Deloitte quantifies the readiness gap precisely: governance readiness at 30%, technical infrastructure at 43%, data management at 40%, and talent readiness at just 20%. The conclusion is direct: adoption is no longer the primary challenge. The next phase of enterprise AI depends on operational maturity.

The organisations deploying AI fastest are building competitive advantages that will compound. The organisations deploying AI without governance are building liabilities that will compound instead. Both are doing it at speed. Only one of them knows it.

The 2026 State of AI report found that 88% of organisations worldwide now use AI regularly in at least one business function. Yet only 6% generate the kind of business outcomes that define genuine AI success.

The gap between 88% adoption and 6% meaningful outcome is not a capability gap. It is a governance gap. And it is the same gap that made the incidents of March 2026 possible.