According to the Thales 2026 Data Threat Report, 70 percent of companies see AI as the most significant data security risk. AI is shifting from a tool to a trusted insider with broad access to company data, often with less control than applies to human users.
As organizations integrate AI into workflows, analytics, customer service, and development pipelines, these systems gain broad, automated access to corporate data. “Insider risk is no longer just about people. It is also about automated systems that have been trusted too quickly,” says Sebastien Cano, Senior Vice President of Cybersecurity Products at Thales.
Data visibility lags behind AI adoption
The report shows a gap between AI adoption and data management. Only 34 percent of organizations know where all their data is located, and only 39 percent can fully classify it. Meanwhile, nearly half (47 percent) of sensitive cloud data remains unencrypted and compromised.
Credential theft remains the top attack technique on cloud management infrastructure, according to 67 percent of organizations that have experienced cloud attacks. At the same time, 50 percent consider secrets management one of their top application security challenges.
As organizations rush to adopt AI, attackers are doing the same. Nearly 60 percent of companies report attacks based on deepfakes, and 48 percent report reputational damage from AI-generated disinformation or impersonation campaigns.
AI not only introduces new risks but also accelerates existing ones. Human error already contributes to 28 percent of data breaches. With additional automation, small errors can scale up more quickly and spread further.
Although 30 percent now set aside specific budgets for AI security, the majority (53 percent) still rely on traditional security programs designed primarily for human users and perimeter security.