[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6k7Mp0joiwm8i4ej_WDMjQd3oW6ot1NVwYydHUVEM0g":3},{"article":4,"iocs":53,"watch_terms":54,"solutions":55,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"2b2eb528-e14c-474f-8fa9-b99c72ec6602","87% say their AI controls need to work better","87-say-their-ai-controls-need-to-work-better-5ec784","The AI running inside large companies has stopped waiting for permission. Across five categories of AI, from chatbots to process automation, more than half of 3,600 business decision-makers say the systems their teams use can act within defined rules without routine review, or finish whole processes with no human approval. 87% of those same respondents say their organization needs a better way to approve, monitor and control how AI gets used. Vanson Bourne ran the … More → The post 87% say their AI controls need to work better appeared first on Help Net Security.","A survey reveals that 87% of business decision-makers believe their organizations need better AI controls. Many AI systems operate with significant autonomy, leading to security, privacy, and compliance issues. Companies are investing heavily in AI but struggle with governance, leading to potential risks like unmanaged access and decision ownership confusion.","Most companies lack adequate AI controls, leading to security and compliance risks.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F06\u002Fautonomous-ai-oversight-governance\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002F02135045\u002Fai-1500-2.webp","2026-11-06T06:00:03+00:00","2026-11-06T07:00:24.894625+00:00",7,[17,20,22,25,28],{"name":18,"type":19},"Generative AI","product",{"name":21,"type":19},"LLMs",{"name":23,"type":24},"AI","technology",{"name":26,"type":27},"Vanson Bourne","vendor",{"name":29,"type":27},"Avanade","839da5c1-3c34-47e2-9499-f7201640e3ac",{"id":30,"icon":32,"name":33,"slug":34},null,"AI Security","ai-security",[36,41,46,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[26,29,18],{"controls":56,"vendors":137},[57,86,112],{"slug":58,"name":59,"problem":60,"products":61},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":87,"name":88,"problem":89,"products":90},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",[91,97,104],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":92,"product_name":93,"url":95,"description":96},"appomni","AppOmni","\u002Fvendor-logos\u002Fappomni.png","https:\u002F\u002Fappomni.com\u002F","SaaS security posture management for platforms such as Salesforce, Microsoft 365 and ServiceNow.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":99,"url":102,"description":103},"obsidian-security","Obsidian Security","\u002Fvendor-logos\u002Fobsidian-security.png","obsidian","https:\u002F\u002Fwww.obsidiansecurity.com\u002F","SaaS posture management and detection of account and integration compromise.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-shield","Falcon Shield","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Ffalcon-shield\u002F","SaaS security posture management, from CrowdStrike's acquisition of Adaptive Shield.",{"slug":34,"name":113,"problem":114,"products":115},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-ai-gateway","Boomi AI Gateway","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fai-gateway\u002F","Gateway for AI model and MCP tool traffic, built on Lunar.dev technology. It limits which tools each agent can call. Its enterprise version adds an approval step for new MCP servers and logs each call with the user or agent behind it.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","ai-defense","Cisco AI Defense","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Fai-defense\u002Findex.html","Discovery of AI use, testing of models and guardrails for AI applications.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":133,"product_name":134,"url":135,"description":136},"boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",[],{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":150},"87-of-organizations-admit-ai-governance-controls-are-falling-short","87% of Organizations Admit AI Governance Controls Are Falling Short","A sweeping survey of business decision-makers reveals that the vast majority of organizations recognize their AI systems are operating with more autonomy than their controls can safely manage. Without clear governance frameworks, AI tools can access sensitive data, make consequential decisions, and interact with external systems in ways that bypass traditional security and compliance checks. This creates compounding risks: unmanaged access permissions, blurred accountability for AI-driven decisions, and gaps that regulators are increasingly scrutinizing. The urgency is amplified by rapid AI investment outpacing policy and control development, leaving organizations exposed before safeguards are in place.",[143,144,145,146,147,148,149],"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 5: Account Management","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","GDPR Article 32","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(b)","ISO\u002FIEC 27001:2022 Clause 7.2: Competence",{"GDPR Article 32":151,"NIS2 Article 21(2)(b)":152,"CIS Control 5: Account Management":153,"NIST SP 800-53 SI-2: Flaw Remediation":154,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":155,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":156,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":157},"AI systems processing personal data without adequate controls directly breach the obligation to implement appropriate technical and organisational measures to ensure data security and lawful processing.","NIS2 explicitly requires organizations to implement incident handling and risk management policies covering automated systems, making ungoverned AI autonomy a direct compliance gap for in-scope entities.","Uncontrolled AI system access stems from failure to manage non-human identities; CIS Control 5 requires inventorying and governing all accounts, including service and machine accounts used by AI tools.","Governance gaps in AI deployment represent systemic flaws that require structured remediation processes — this control mandates identifying and correcting information system weaknesses, including those in automated systems.","Confusion over decision ownership and AI governance indicates a skills and awareness gap; this clause requires organizations to ensure staff have the competence to manage the security implications of the systems they deploy.","AI systems with unreviewed configurations and ungoverned autonomy represent an unmanaged technical risk; this control requires organizations to systematically identify and remediate such vulnerabilities.","AI systems operating with unmanaged access directly violates the principle that access to assets should be granted only to authorized entities with appropriate permissions — this framework item would require scoping and limiting AI system privileges."]