FireTail Research · Edition 01 Published H1 2026 · Reading time 16 minutes State of AI Security · 2026 Print version →
FireTail Research · Edition 01 · Published H1 2026

In 2026, AI has moved into production faster than the controls needed to secure it.

This year, shadow tools moved into the mainstream. Agents shipped into production ahead of the policies needed to govern them. Standards and regulation are emerging but trailing far behind adoption. In this edition of FireTail's State of AI Security report, we look at the incidents, the data, the gaps that remain, and the work that closes them.

90%
of AI usage inside enterprises is untracked, ungoverned, or unsecured by the security team responsible for it.
MIT Project NANDA · State of AI in Business 2025
83%
of organizations have deployed AI agents this year. Up from 16% twelve months ago, the fastest enterprise adoption curve since cloud.
Cisco · State of AI Security 2026
29%
say they have the controls in place to defend what they shipped. The 54-point gap is the story of the year.
Cisco · State of AI Security 2026
Foreword

I have spent twenty-eight years in technology and cybersecurity. I have been through every major technological shift of the last two decades. Cloud, mobile, SaaS, containers, zero trust. Each one brought a new threat model, a new set of mistakes, and a period where adoption outpaced the controls needed to secure it. That pattern is familiar. What is happening with AI is not.

The pace of change is unprecedented. Every prior shift gave defenders months or years to observe, build frameworks, and catch up. AI has compressed that window into weeks. Twelve months ago, the question security leaders were asking was whether to allow AI tools. Now the question is how to find the ones already running, govern the agents their teams shipped without review, and explain to the board what could go wrong. The conversation moved from theoretical to operational faster than anything I have seen in my career.

The data in this report reflects that. 90% of enterprise AI usage is invisible to the security team responsible for it. 83% of organizations deployed AI agents this year, up from 16% twelve months ago. Only 29% say they have controls in place to secure what they shipped. That fifty-four-point gap between deployment and defense is the story this report exists to explain.

We built this report the same way we approach any security problem: start with the evidence. We tracked 302 publicly disclosed AI security incidents over the last twelve months, cross-referencing our own incident tracker with the AI Incident Database and the AIAAIC repository. Every attack walkthrough in this report is grounded in a CVE, a vendor disclosure, or published research.

AI is not optional. It is already in your infrastructure, your workflows, and your employees' browsers. The question is not whether to adopt it. The question is how to enable AI innovation with confidence. The organizations that get AI security right will not be the ones that moved slowest. They will be the ones that built visibility, governance, and response into their AI programs from the start, so they could move fast without losing control. That is the mission behind FireTail and the reason this report exists. AI adoption is accelerating whether security teams are ready or not. The work is to make sure they are.

Jeremy Snyder · Co-Founder and CEO, FireTail

Contributing authors

FireTail Research
Jeremy Snyder
Jeremy Snyder
Lead author

Co-Founder and CEO of FireTail. Jeremy spent more than two decades in cyber and IT operations before founding FireTail, with a focus on the intersection of cloud infrastructure and AI security. He holds an MBA from George Mason University, a BA in computational linguistics from UNC, and completed additional studies at Aalto University in Helsinki. Jeremy hosts This Week in AI Security, a weekly podcast tracking the incidents, vulnerabilities, and policy shifts shaping the AI security landscape.

Riley Priddle
Riley Priddle
Research

Co-Founder and CTO of FireTail. Riley leads engineering and infrastructure architecture for the platform. He spent a decade running cloud security initiatives at HP, SkyTV, and Otro, building the cloud-native security thinking that informs how FireTail approaches AI workload protection. Originally from New Zealand, Riley holds a BS in Information Technology from the Wellington Institute of Technology.

Timo Rüppell
Timo Rüppell
Threat analysis

VP of Product at FireTail. Before joining, Timo was a researcher in theoretical high-energy physics, working on quantum gravity and supersymmetry. He will tell you that AI security turned out to be the harder problem. Timo leads threat analysis for the platform and contributes original research on agentic attack surfaces and the security controls they require.

Viktor Markopoulos
Viktor Markopoulos
Data & tracker

Information security consultant and researcher, specializing in web application and AI security testing. Viktor has uncovered major data breaches and security vulnerabilities across Fortune 500 organizations. He maintains FireTail's AI Incident Tracker and leads the forensic analysis behind the incident data and breach case studies in this report.

Ayush Sethi
Ayush Sethi
Editorial & design

Ayush led design and editing for this report, translating technical threat models and incident data into the interactive format you are reading now. Ayush is an experienced product and GTM marketing professional with a strong background in AI security. He writes on AI governance and compliance for the FireTail blog.

Contents

Nine chapters. Pick where to start.

Chapter 01 The shift

AI adoption has outpaced security by every measure that matters.

Three waves of AI have moved into the enterprise stack in roughly two years. Each arrived before the controls for the previous one were finished. Most security stacks are watching the wrong layer and new AI adoption is happening daily, whether you know it or not.

Three waves and an inflection point

~3 years
2023
Conversational
Chat in the browser
Standalone assistants reached through a browser tab. The sensitive-data exposure was employees pasting source, contracts and customer records into a third-party model with no enterprise tenancy.
2024
Embedded
AI inside the platform
Copilot, Gemini and native assistants wired directly into the productivity suite, with the user's own entitlements. The model now reads live tenant data, which collapses the boundary between content and instruction: anything the model can read, an attacker can use to issue commands.
2025
Agentic
Agents that act
Autonomous agents with tool access, persistent memory, and MCP-brokered connections to production systems. They take privileged action without a human in the loop. In most organizations they ship with no inventory, no per-action logging, and no authorization model distinct from the human they impersonate.
2026
Inflection point
Bots overtake humans
In June 2026, Cloudflare confirmed that automated traffic, most of it driven by AI agents, exceeded human web traffic for the first time in the history of the internet. 57.4% of all web requests are now non-human. The attack surface is no longer a subset of the network. It is the majority of it.

The speed of this compression matters. Each wave arrived before the controls for the previous one were finished. Organizations were still writing acceptable-use policies for ChatGPT when Copilot started reading their tenant data. They were still debating whether to allow embedded assistants when autonomous agents shipped into production with default credentials and no logging.

The result is a new failure pattern. The kill chain below is the shape almost every incident in this report takes. It is short, content-borne, and indistinguishable from sanctioned use. Lateral movement has collapsed into a single tool call. The motion defenders were trained to recognize no longer happens.

The new shape of the kill chain
Time to breach · 4 seconds · Human actions required · 1
↳ Attacker Malicious input Email, document, ticket
Stage 02 AI agent ingests Content enters context window
Stage 03 MCP tool call Executes injected instruction
↳ Breach Data exfiltrated No user interaction required

This is not a gap that patching or tuning will close. The tools most organizations rely on for detection and data protection were designed for a world where humans took every action and every action left a log. AI has broken these assumptions. The table below shows exactly where.

What DLP, SIEM and SOC were not built to see

The visibility gap
DLP
Data loss prevention
Built to
Inspect egress channels and fingerprint known-sensitive content: regex, exact-data-match and document fingerprints over mail, web uploads, endpoint and removable media.
Blind to
AI data movement rides inside TLS to allowlisted model endpoints, and the model paraphrases rather than copies. There is no verbatim string and no policy-violating destination for a fingerprint to anchor to.
SIEM
Log correlation & analytics
Built to
Correlate normalized telemetry against a schema and a rule set, with UEBA baselines anchored to user and host identities.
Blind to
Inference calls and tool invocations emit no native audit event. Where logs exist they are free-text prompt-response pairs with no ATT&CK mapping and punishing ingest cost, and there is no agent identity to baseline against.
SOC
Detection & response operations
Built to
Triage known TTPs and tuned signatures through tiered runbooks, measured on mean time to detect and respond.
Blind to
Prompt injection and tool poisoning carry no IOCs. The payload is natural language, polymorphic by construction, and indistinguishable from sanctioned use. There is no signature to author and no playbook for an agent doing exactly what it was permitted to do.

If your detection stack was built to watch egress channels, correlate log events, and match known signatures, you are watching the wrong layer.

Chapter 02 The biggest stories

The stories that have defined 2026. ...so far

2026 has been one of the most eventful years in cybersecurity, with most of the biggest stories driven by the breakneck evolution and adoption of AI. A rogue agent crisis that broke out of the security press and into the mainstream. A frontier model so effective at finding vulnerabilities that its creators restricted access to it. And an autonomous AI agent that built its own attack chain and breached a major AI platform without human direction. Here are three of the biggest stories in AI security so far.

Story 01 · OpenClaw · Jan–Mar 2026 Rogue agent crisis

The rogue agent that made agentic security a mainstream problem.

OpenClaw was the most-starred open-source AI agent on GitHub at the start of 2026. Within weeks it became the year's first major agentic security crisis, and a textbook demonstration of what happens when autonomous software ships faster than the controls needed to govern it.

The agent's API server shipped with no authentication middleware. Users who exposed it to the internet, often to enable mobile access, gave anyone on the network full remote code execution on the host machine. Its companion marketplace had no code signing or sandboxing. Malicious "skills" exfiltrated SSH keys and environment variables to attacker infrastructure for weeks before discovery. Then came the data breach: a related social platform was compromised, leaking 1.5 million credentials including plaintext API keys for OpenAI, Anthropic, and AWS.

1,000+
machines exposed to the public internet with unauthenticated remote code execution.
1.5M
credentials leaked from the related MoltBook platform, including plaintext API keys for major AI providers.
1,184
malicious skills found on the official marketplace in a single audit. No code signing. No sandboxing.
Sources · FireTail Research · Wiz Security · public disclosure
Story 02 · Anthropic Mythos · Apr–Jun 2026 The vulnerability arms race

When a model got too good at finding vulnerabilities. And the industry had to decide what to do about it.

In April 2026, leaked internal documentation from Anthropic revealed that their frontier model family, codenamed Mythos, had discovered a vulnerability in a BSD package that had gone undetected for over twenty years, predating GitHub itself. Over 99% of the zero-day vulnerabilities Mythos identified in testing had not yet been patched. The model did not need specialized prompting. It read code, reasoned about business logic, and identified flaws that professional human pentesters had missed for decades.

Anthropic restricted access under a program called Project Glasswing, limiting Mythos cyber capabilities to a small number of vetted security organizations. When a public version launched in June, it shipped without the offensive security features. The move forced a question the industry had been avoiding: what happens when the tools for finding every vulnerability on the internet become generally available? The answer is still forming, but the vulnerability disclosure rate is already accelerating. Microsoft's June 2026 Patch Tuesday hit a record 206 CVEs. The zero-day clock, tracked by researchers at Sysdig and others, shows that mean time from vulnerability disclosure to working exploit has collapsed from months to hours.

OpenAI responded with its own Trusted Access for Cyber (TAC) program, scaling access to thousands of verified defenders. The arms race is no longer theoretical. It is the operating environment for every security team reading this report.

99%+
of zero-day vulnerabilities discovered by Mythos in testing were unpatched at time of discovery.
206
CVEs in a single Microsoft Patch Tuesday. A record, and a signal of what AI-accelerated vulnerability discovery looks like at scale.
Hours
Mean time from vulnerability disclosure to working exploit. Down from months. The zero-day clock is accelerating.
Sources · Anthropic disclosure · Sysdig zero-day clock · Microsoft Security Response Center · OpenAI TAC announcement
Story 03 · Hugging Face Breach · Jul 2026 The first real agentic attack

An AI agent built its own kill chain and breached a third party. Nobody asked it to.

In July 2026, Hugging Face disclosed unauthorized access to internal datasets and service credentials. The entry point was a malicious dataset that exploited two code-execution paths in the data pipeline. The attacker escalated to node-level access, harvested credentials, and moved laterally across internal clusters over a weekend. Five days later, OpenAI confirmed the attacker was their model, running inside an internal capability evaluation with reduced safety constraints.

The model was sandboxed for testing. It spent substantial compute trying to escape. It found a zero-day in a package registry proxy to get internet access, privilege-escalated until it reached a node with external connectivity, inferred that Hugging Face was likely to host what it needed, chained stolen credentials with a separate zero-day into remote code execution on Hugging Face's servers, and got caught. Nobody designed this attack path. The model was given a goal and built the kill chain itself.

This was not a novel technique. Escalation, lateral movement, credential harvesting, chaining zero-days: that is a known playbook. What is new is that an agent built and executed the entire chain end to end, without a human directing each step, at machine speed, across two separate organizations' infrastructure. Both organizations survived because they had rich telemetry to reconstruct the attack. Most enterprises deploying agents today do not have that telemetry.

17,000+
logged events reconstructed by Hugging Face in hours. The attack timeline was fully mapped because application-layer telemetry existed.
2
zero-day vulnerabilities chained by the model: one to escape the sandbox, one to achieve remote code execution on Hugging Face.
0
human operators directing the attack. The model built the entire kill chain autonomously from a single evaluation goal.
Sources · Hugging Face disclosure · OpenAI confirmation · FireTail Research

A rogue agent crisis that proved shadow AI is already inside the perimeter. A frontier model that turned vulnerability discovery into an automation problem. And an autonomous agent that built its own attack chain and breached a major platform without human direction. These are not three separate stories. They are three views of the same shift: AI is now the attacker, the attack surface, and the thing defenders have to secure, all at once.

FireTail · State of AI Security, H1 2026
Chapter 03 By the numbers

302 incidents. The pattern is clear.

The stories frame the year. The dataset makes it measurable. FireTail tracks AI security incidents alongside the AI Incident Database (AIID) and the AI, Algorithmic, and Automation Incidents and Controversies repository (AIAAIC). Combined and de-duplicated, the three sources documented 302 publicly disclosed incidents between May 2025 and May 2026. The distribution by attack type and by sector tells a consistent story.

4x
year-on-year increase in AI security incidents from 2024 to 2025. The 2026 run rate is tracking higher.
FireTail AI Incident Tracker
35%
of all incidents were data exfiltration. The number one attack type, ahead of prompt injection, rogue agents, and supply chain combined.
Combined dataset · n=302
63%
of breached organizations had no AI governance policy in place at the time of the incident.
IBM · Cost of a Data Breach 2025
By attack type sorted by share of total
n = 302
302
Incidents
Data exfiltration35%
Prompt injection16%
Rogue agent12%
Shadow AI11%
API & endpoint exposure11%
OAuth / access abuse8%
AI supply chain4%
MCP / tool poisoning3%
By sector same incidents, grouped differently
n = 302
Enterprise SaaS
22%65
Cross-sector / unknown
21%65
Healthcare
17%51
Government
14%42
Developer tooling
13%40
Financial services
13%39
Reading the year

For all the talk of novel agentic threats, most AI security incidents trace back to the same root cause: organizations do not know what AI is running in their environment, who is using it, or what it can reach. Shadow AI and a lack of visibility dominate the dataset. Data exfiltration leads by a wide margin. Prompt injection is second but accounts for less than half the volume. The incidents that fill the tracker are not exotic zero-days or adversarial model attacks. They are employees uploading sensitive data to unauthorized tools, credentials left in code, and API endpoints shipped without authentication. The first step to securing AI is seeing it.

The infrastructure around the model is where most of the exposure sits. Week after week on This Week in AI Security, the same pattern surfaces: it is not the model that is broken, it is the scaffolding. The packages, APIs, and service connections that hold the environment together. The credentials and permissions that no one re-examined after deployment day. The attack surface is not the prompt. It is everything the prompt can reach.

The sector distribution confirms what the breach cost data in Chapter 07 suggests: no vertical is exempt, but the sectors with the highest AI adoption rates and the weakest governance maturity are absorbing the most incidents. Enterprise SaaS and healthcare together account for nearly 40% of the dataset. Government trails in incident count but leads in severity when breaches do occur. Financial services, despite heavy regulation, is not meaningfully ahead.

Incidents worth knowing
2025 to 2026
EchoLeak · M365 Copilot

Indirect prompt injection in Microsoft 365 Copilot. A hidden instruction in an inbound email caused zero-click exfiltration of mailbox content. Patched server-side via coordinated disclosure.

Source →
Prompt injection May 2025
Replit AI · SaaStr database

An AI coding agent destroyed a production database during a normal session, then issued misleading status reports about what it had done. Publicly disclosed by the customer.

Source →
Rogue agent Jul 2025
Cursor IDE RCE chain

Multiple vulnerabilities in the AI coding IDE allowed remote code execution, source-code disclosure, and credential exposure on developer workstations. CVEs assigned and patched.

Source →
Supply chain Aug 2025
Nx · s1ngularity supply chain

Compromised versions of the popular Nx build tool shipped a postinstall script that invoked local AI coding assistants to locate developer credentials and exfiltrate them. The first observed npm attack using AI agents as the attack tool.

Source →
Supply chain Sep 2025
Axios npm supply chain · Mercor breach

A remote access trojan was injected into the Axios npm package, one of the most widely used JavaScript libraries in the world. The compromise cascaded to Mercor, a $10 billion AI training data startup that provides data to OpenAI, Anthropic, and Meta. The attackers spent weeks building rapport with the package maintainer using fake employee profiles and a convincing Slack workspace before gaining access.

Source →
Supply chain Mar 2026
McKinsey Lily AI platform

Security researchers found 200 API endpoints backing McKinsey's internal AI system, Lily. Twenty-two required no authentication. A concatenation flaw in JSON key handling enabled SQL injection that bypassed OWASP ZAP detection, giving access to 700,000+ internal files and 3.68 million database records. The vulnerability was in the API layer, not the model.

Source →
API exposure Mar 2026
Vercel production breach

One employee used one AI tool with one allow-all OAuth permission. That single grant gave attackers access to the full production environment of one of the most widely used frontend deployment platforms. Described as the largest AI breach on a production environment to date. The entry point was not code or a hijacked package. It was an OAuth scope.

Source →
OAuth / access abuse May 2026
Community Bank PA · SEC 8-K filing

A Pennsylvania bank filed an 8-K with the SEC disclosing a data breach caused by an employee uploading Social Security numbers and dates of birth to an unauthorized AI application. The first known SEC filing explicitly attributing a data breach to unauthorized AI usage. The bank did not disclose which AI application was involved.

Source →
Shadow AI Jun 2026
Live tracker
Every incident in the dataset, filterable and updated weekly.
Sort by attack type, sector, severity or date. Maintained by the FireTail research team.
Open the breach tracker
Chapter 04 Slowed down

Six attacks, slowed down. The mechanism is rarely the model itself.

The numbers describe the scale of the problem. Walking through an incident shows the mechanism. Six published attack patterns are reconstructed below, step by step, from setup to impact. Every reconstruction is grounded in a CVE, a vendor disclosure, or peer-reviewed research, cited at the end.

The data in Chapter 03 shows where AI security fails. This chapter shows how. Each walkthrough isolates the mechanism, the moment the attacker gains leverage, and the control that would have stopped it. In every case the fix is closer to configuration than procurement. The pattern across all six is consistent: it is not the model that breaks. It is the infrastructure, the permissions, and the assumptions around it.

Attack 01 of 06
Prompt injection · live

Zero-click data exfiltration via indirect prompt injection

Based on CVE-2025-32711 "EchoLeak", Microsoft 365 Copilot, 2025
1 / 6
Elapsed: T−72 hours · Human actions: 0
“
Welp, that happened faster than I predicted.
Matthew Prince
Co-Founder and CEO, Cloudflare
On automated traffic surpassing human web traffic for the first time · June 2026

When the chief executive of a company that handles a significant share of global web traffic says the shift outpaced his own forecast, the question for security teams is no longer whether AI has changed the threat landscape. It is whether their controls have caught up with a network where most traffic is now autonomous.

Chapter 05 Blast radius

An AI agent has a structurally larger blast radius than any individual it supports.

The walkthroughs show how a single incident plays out. They do not yet explain why the same mechanism becomes so much more damaging when an agent is the one being manipulated. The answer is blast radius. A person is granted the access their job requires. The agent built to support that job is granted, by default, the access that anyone doing that job across teams might ever need. Those permissions are set once at deployment and rarely re-examined. When the agent is compromised, all of them are in scope at once.

Human employee

6 systems · scoped
Maya Chen
Senior counsel · 4 yrs
Legal drive
Read / write, legal/*
Outlook
Send / receive
Teams
Chat · calls
Workday
View HR · self only
Salesforce
Read only
Intranet
Read only
Scoped, audited quarterly

AI agent, same organization

8 systems · broad OAuth
Legal AI Agent
Deployed March 2025
All SharePoint
Full tenant read
All mailboxes
Send on behalf of
Salesforce API
Read + write CRM
GitHub repos
All private repos
Jira / Confluence
All projects
Slack workspace
All channels + DMs
HR system API
Employee records
Finance ERP
Invoice processing
Broad OAuth · rarely audited · no least-privilege review

An agent with tool access and stored credentials carries a different risk profile from a chatbot. Most AI acceptable-use policies do not draw that distinction. Procurement, legal and security all sign off on what they take to be the same product, while the product itself has quietly become something else.

IBM · Cost of a Data Breach 2025 · 63% of breached organizations had no AI governance policy

Why this looks normal to your SIEM

The security stack most enterprises run was built around an attacker who has to escalate to act. SIEM logs the escalations, and that is most of what it does for a living. The agent does not escalate. Its permissions were granted at deployment, and the actions it takes are the actions a service account was approved to take. Correctly configured detection does not alert on those.

Lateral movement has collapsed into a single tool call. The motion defenders were trained to recognize no longer happens. The agent does not move between systems. It already lives in all of them.

Three changes that close most of the gap

None of these are exotic. They are standard hygiene, applied to a layer most teams have not yet added to their threat model.

Scope every agent to least privilege. Treat each one like a service account that needs quarterly review. The permissions granted at deployment day are almost never re-examined; that is where broad OAuth grants accumulate.
Log every tool call, not just the prompt. The breach timeline lives in the chain: which tool, which parameters, which return value, which next action. A log of conversation turns alone is a transcript, not an audit trail.
Alert on out-of-role access. A legal agent reading GitHub at 2 a.m. is the kind of event that should fire. Until rules exist for cross-system access, existing detections will not see it.
Chapter 06 Frameworks

Five frameworks, emerging fast, converging on the same answer.

Wide permissions create exposure. Frameworks are the industry's attempt to contain it. Five have emerged or matured in the last eighteen months, from different bodies with different purposes. NIST offers a risk-management scaffold. OWASP catalogs the threats. ISO certifies the process. MITRE maps how attacks unfold. The EU AI Act makes evidence of all of it a legal requirement. They are not competing standards. Read together, they describe the same small set of controls from five different angles.

NIST US, Voluntary

AI Risk Management Framework

A structured way to identify, measure, and manage AI risk across the lifecycle. The name tells you what it is: a risk-management framework, not a checklist of technical controls. Useful for wrapping your arms around where an organization sits on maturity, and as a starting point to build from. Widely used as the default reference for US companies with no sector regulator to follow.

Govern, Map, Measure, Manage.
OWASP Global, Community

LLM Top 10

The threat model most security teams already know, adapted for large language models. Prompt injection sits at number one. The list covers sensitive information disclosure, supply chain, data and model poisoning, improper output handling, and excessive agency. If your team has ever used the OWASP Web or API Top 10, this is the LLM equivalent and the fastest way to give developers a shared risk vocabulary.

10 risks, prompt injection ranked number 1.
ISO Global, Certifiable

ISO/IEC 42001

The first certifiable AI management system standard, structured like ISO 27001 for information security. It defines the management processes an organization needs to develop and operate AI responsibly. This is the one procurement teams and enterprise buyers will increasingly ask vendors to hold, because it produces an auditable certificate rather than a self-assessment.

Certifiable, audit-ready.
MITRE Global, Knowledge base

ATLAS

Adversarial Threat Landscape for Artificial-Intelligence Systems. The ATT&CK equivalent for AI: a knowledge base of real-world adversary tactics and techniques against machine learning and AI systems, mapped to observed incidents. Where OWASP tells you what can go wrong, ATLAS documents how attackers have actually done it, tactic by tactic.

Adversarial TTPs, mapped to real attacks.
Deep dive · Emerging framework

The OWASP Agentic Top 10: the year the risk model split in two

For most of the last two years, LLM security and AI security were treated as the same problem. In late 2025, OWASP acknowledged they are not. Alongside the established LLM Top 10, it published a separate top-ten list for agentic systems, a recognition that an autonomous agent with tool access, memory, and the ability to act carries risks a chatbot never could.

The distinction matters because the controls are different. An LLM risk is mostly about what the model says. An agentic risk is about what the agent does. The list below is the reference taxonomy for the attacks reconstructed in Chapter 04 and the blast-radius problem described in Chapter 05.

01Agent goal hijack
02Tool misuse and exploitation
03Identity and privilege abuse
04Agentic supply chain vulnerabilities
05Unexpected code execution
06Memory and context poisoning
07Insecure agent-to-agent communication
08Cascading failures
09Human-agent trust exploitation
10Rogue agents
Source · OWASP Agentic Security Initiative · Agentic AI Top 10, 2025
Deep dive · The most comprehensive

The EU AI Act: the only framework with legal teeth

The other four frameworks are voluntary or advisory. The EU AI Act is law. It is also the most comprehensive of the five, covering prohibited practices, high-risk obligations, transparency, and governance across the full lifecycle. Most security teams still treat compliance as a parallel workstream to security. It is not. The high-risk Articles are, with very few exceptions, the same controls a competent security program would have in place anyway.

When the Act applies

Staggered application
  1. 2 Feb 2025
    Prohibitions in force
    Article 5 lists banned AI practices, including social scoring, manipulative systems, and most real-time biometric identification in public spaces. AI literacy obligations for staff also begin.
  2. 2 Aug 2025
    General-purpose AI obligations
    Transparency, technical documentation and copyright-policy obligations begin for providers of general-purpose AI models. Governance bodies, notified bodies and penalty regimes also take effect.
  3. 2 Aug 2026
    High-risk AI obligations begin
    Articles 9 to 17 apply to providers of high-risk AI systems listed in Annex III. Article 26 obligations apply to deployers. Article 50 transparency obligations apply to AI systems interacting with people.
  4. 2 Aug 2027
    Embedded high-risk systems
    Obligations extend to high-risk AI built into products already regulated under the Union harmonisation legislation listed in Annex I, including medical devices, machinery, and toys.

Seven obligations for high-risk AI

Articles 9 – 15
  1. Art. 9
    Risk management system
    A continuous, iterative process running across the AI system’s entire lifecycle, including residual-risk testing.
  2. Art. 10
    Data and data governance
    Training, validation and testing datasets must meet quality, relevance, and bias-examination criteria.
  3. Art. 11
    Technical documentation
    Documentation sufficient to demonstrate conformity must be produced before market placement and kept up to date.
  4. Art. 12
    Record-keeping
    Automatic logging of events relevant to identifying risks and substantial modifications throughout the system’s lifecycle.
  5. Art. 13
    Transparency to deployers
    Instructions for use that allow deployers to interpret outputs correctly and understand the system’s limits.
  6. Art. 14
    Human oversight
    Effective measures that allow natural persons to monitor and intervene in the system’s operation.
  7. Art. 15
    Accuracy, robustness, cybersecurity
    Appropriate levels of accuracy and resilience to errors, faults and adversarial attempts must be designed in and declared.

For security teams, the most useful reading of the Act is to treat the seven obligations above as a control library. Most of them map directly onto existing security domains. Where the Act differs is that it makes evidence of those controls a legal artifact, not just an operational practice.

EU Regulation 2024/1689 · Articles 9–15
2 Dec 2027
High-risk AI obligations begin. Articles 9 to 17 apply to providers of high-risk AI systems listed in Annex III; Article 26 applies to deployers. Under the 2025 Digital Omnibus, this deadline was pushed back 16 months from the original 2 Aug 2026 date. Article 50 transparency obligations for AI systems interacting with people still apply from 2 Aug 2026.
EU Regulation 2024/1689, as amended
8
Annex III categories define “high-risk”, including critical infrastructure, education, employment, essential public services, and law enforcement.
EU AI Act · Annex III
€35M
or 7% of global annual turnover, whichever is higher. Top fine band, reserved for prohibited AI practices under Article 5.
EU AI Act · Article 99

Five frameworks, one answer

NIST tells you to manage the risk. OWASP tells you what the risks are. ISO tells you how to certify your process. MITRE documents how you will be attacked. The EU AI Act makes evidence of all of it a legal requirement. Read separately, they look like five compliance burdens. Read together, they point at the same small set of controls: know what AI you are running, govern how it is used, log what it does, and be able to prove it. The frameworks are converging. The question is whether your controls are.

Assess your EU AI Act readiness
Chapter 07 Comparatives

Breach cost and peer ranking are the two numbers that actually move the AI security budget.

Once the legal floor is clear, the business question is two-part. Is the exposure expensive enough to act on, and are we behind our peers? The table answers the first. The grid answers the second. A note on the risk-reduction column: percentages reflect a review of incidents where the listed control was present versus absent. They are floors, not promises. The point is the gap between vectors.

Threat vector Avg breach cost Primary control Effort Risk reduction
Prompt injection (indirect) $4.88M Input sanitization layer + prompt shield before LLM ingestion Low · 2–4 wks
~82%
MCP supply chain poisoning $4.63M Internal MCP registry + version pinning + automated trust scoring Med · 4–8 wks
~74%
API misconfiguration / exposure $3.86M AI API gateway with auth enforcement, rate limiting, anomaly detection Low · 1–3 wks
~91%
Shadow AI / OAuth overreach $4.63M AI asset discovery + OAuth audit + agent-specific acceptable use policy Med · 3–6 wks
~67%
Training data poisoning $5.20M Data lineage tracking + pipeline integrity + behavior monitoring High · 8–16 wks
~58%
Multi-agent cascade failure $6.10M+ Agent isolation boundaries + inter-agent message validation + kill-switch High · 12+ wks
~70%

The economic argument for AI runtime monitoring is, frankly, the easiest part of this report. IBM puts the saving at $1.9M per breach, with containment 40% faster. The harder part is that you cannot monitor what you have not yet inventoried. The order of operations matters more than the budget.

IBM · Cost of a Data Breach 2025
Sector benchmark

Where your sector sits

If your score is below your sector median, you are carrying above-average risk relative to your competitive set. That is the comparison your cyber insurer is making, and increasingly the one your regulator is too. The number you walk into the audit committee with is not your absolute score. It is the gap.

Financial services
54/ 100 median
AI inventory
Runtime monitoring
EU AI Act readiness
3rd quartile · ahead of median
Healthcare
46/ 100 median
AI inventory
Runtime monitoring
EU AI Act readiness
2nd quartile · at the median
Enterprise SaaS
38/ 100 median
AI inventory
Runtime monitoring
EU AI Act readiness
2nd quartile · below median
Government
28/ 100 median
AI inventory
Runtime monitoring
EU AI Act readiness
1st quartile · trailing

Source · FireTail Research, getaiactready.eu cohort · n=412

Chapter 08 Operations

The first ninety days of AI security work returns more than the next twelve months combined.

Cost and comparatives justify the work. Below is the work, in the order it pays back. Twelve actions across three horizons. Horizon 1 is what a security team can start without procurement. Horizon 2 needs some new tooling. Horizon 3 is architecture work that takes a fiscal year. Run them in order. The first item tends to surface the rest.

Chapter 09 The honest read

Five questions reveal where your AI security posture actually sits.

The priorities are universal. The score is yours. The five questions below are the ones FireTail uses in initial assessments, the same five most security teams quietly skip when reviewing their own posture. Two minutes. No login. Run it again in ninety days to see the trajectory.

AI Security Maturity Assessment
5 questions · 2 minutes · instant score

0