AI Security is now an Operating-Model problem

The AI debate in most organisations still focuses on models.

Which provider. Which benchmark. Which pricing. Which features.

That made sense in 2023 and 2024, when the primary question was whether AI worked at all.

It no longer makes sense in 2026.

The new question is not which model is best.

It is whether the organisation can control the environment in which the model runs.

New research from IBM and Dataiku shows why this matters. IBM’s 2026 study of 2,000 technology CxOs found that two-thirds of CIOs and CTOs feel held accountable for AI systems they do not fully control. Fifty-nine percent cite security and compliance as the leading barriers to scaling AI agents, while only 11% believe they are fully prepared for the expected scale of agent deployment.

Dataiku’s survey of 685 CIOs reached a similar conclusion: 75% plan to use more or different models to improve AI continuity; 74% are considering open-source or open-weight models as a hedge against model unavailability; and 80% have conducted or plan to conduct AI dependency risk assessments. 

Together, these findings point to a clear shift: AI is moving from a technology question to an operating-model question.

Control is the new competitive advantage

For years, access to AI was treated as an advantage.

That is changing. Access is becoming commoditised. Models are improving quickly, costs are falling and capability is widely available.

The advantage will increasingly come from the ability to deploy AI safely at scale, on sensitive data, across critical processes and without creating unacceptable dependency.

IBM’s research shows that organisations that designed for adaptability early—keeping workloads portable and models replaceable rather than creating hard dependencies—reported 10% higher return on AI investment in 2025. 

That is a significant difference.

It reflects a simple reality: organisations that can switch model, cloud or deployment environment without rebuilding their entire AI stack can negotiate better, respond faster to change and avoid being locked into suboptimal arrangements.

This is not about ideology. It is about resilience.

AI security is broader than cybersecurity

When people hear “AI security,” they often think about prompt injection, model attacks or data leakage.

Those risks matter. But the bigger challenge is broader.

AI security is about controlling the entire environment in which AI operates:

• Identity and access.
• Data classification and data movement.
• Model selection and model behaviour.
• Logging, monitoring and traceability.
• Human oversight and accountability.
• Third-party dependency.
• Portability and exit options.
• Deployment location and legal jurisdiction.

In other words: AI security is the ability to remain in control as AI spreads.

IBM’s study shows why this matters. Organisations that built control directly into their AI systems reported 25% fewer incidents than those relying on manual governance. They also deployed 16 times more AI agents, achieved 18% higher operating margins and spent four times less of their AI budgets. 

Control and speed are not opposite.

Control is what enables speed at scale.

The infrastructure question

Many organisations now run significant parts of their AI on external infrastructure: public cloud, managed services and third-party models.

For many low risk use cases, that is entirely reasonable. The best models in the world are often built outside Europe, and organisations should use the best available technology where it makes sense.

But the question changes when AI handles information that matters.

Patient records. Citizen data. Financial information. Industrial IP. Critical infrastructure. Sensitive internal decisions.

For these use cases, the infrastructure decision is a security decision.

Every organisation running critical AI on infrastructure it does not control has already made a governance decision—even if it does not feel like one.

It has accepted dependency on someone else’s models, cloud environment, commercial terms, update cycle and legal jurisdiction.

The practical questions are straightforward:

• What happens if the provider changes its terms?
• What happens if a model update changes behaviour in a critical workflow?
• What happens if the service becomes unavailable?
• What happens if a geopolitical or legal event limits access?
• What happens if the data cannot legally leave a controlled environment?
• What happens if the organisation needs to switch model, cloud or deployment environment quickly?

These are strategic questions. They should be treated with the same seriousness as cyber resilience, supply-chain concentration and business continuity.

A practical path forward

The organisations that will lead in the next phase of AI are not necessarily those with the most advanced models.

They are the ones that can answer “yes” to all of the following:

• Do we know which AI tools, models and agents are in use across the organisation?
• Can we see where sensitive data is flowing and which systems AI can access?
• Do we have clear guardrails for which AI employees can use and for what purposes?
• Can we replace a model or change the deployment environment without rebuilding the entire stack?
• Do we have the ability to run AI in environments we control for sensitive or mission-critical use cases?
• Can we demonstrate to regulators, customers and partners that our AI is governed, monitored and accountable?

At 2021.AI, this is the principle behind GRACE AI Security.

• AI Auto Registry identifies and maintains an inventory of AI systems, models and use cases.
• Gatekeeper Agent helps detect shadow AI and unapproved tools.
• Chat Guardian can prevent sensitive data from reaching unapproved models.
• AI Gateway enables controlled access to approved AI services and models.

The objective is not to slow down AI adoption. It is to make responsible AI practical at scale.

The leadership test

The pressure on CIOs is now obvious. Dataiku found that 72% cannot consistently measure whether all their agents are delivering intended business outcomes. Seventy-six percent believe their role will be at risk if their company fails to show measurable AI gains by the end of 2027. 

But this is not only a CIO issue.

It is a board issue. A CEO issue. A public-sector leadership issue.

Every organisation needs to decide whether it wants AI to spread organically through tools it cannot see, data it cannot control and agents it cannot stop—or whether it wants to create a governed environment where innovation can scale safely.

The window is open now.

It will not remain open indefinitely.