FireTail Research H1 2026 · Reading time 22 minutes State of AI Security · 2026
FireTail Research · Edition 01 · H1 2026

In 2026, AI has moved into production faster than the controls needed to secure it.

This year, shadow tools moved into the mainstream. Agents shipped into production ahead of the policies needed to govern them. Standards and regulations are emerging, but trailing far behind adoption. In this edition of FireTail's State of AI Security report, we look at the incidents, the data, the gaps that remain, and the work that closes them.

90%
of AI usage inside enterprises is untracked, ungoverned, or unsecured by the security team responsible for it.
MIT Project NANDA · State of AI in Business 2025
83%
of organizations have deployed AI agents this year. Up from 16% twelve months ago, the fastest enterprise adoption curve since cloud.
Cisco · State of AI Security 2026
71%
do not have the controls in place to defend what they deployed. The gap between adoption and control is the story of the year.
Cisco · State of AI Security 2026
Foreword

I have spent twenty-eight years in technology and cybersecurity. I have been through every major technological shift of the last two decades. Cloud, mobile, SaaS, containers, zero trust. Each one brought a new threat model, a new set of mistakes, and a period where adoption outpaced the controls needed to secure it. That pattern is familiar. What is happening with AI is not.

The pace of change is unprecedented. Every prior shift gave defenders months or years to observe, build frameworks, and catch up. AI has compressed that window into weeks. Twelve months ago, the question security leaders were asking was whether to allow AI tools. Now the question is how to find the ones already running, govern the agents their teams deployed without review, and explain to the board what could go wrong. The conversation moved from theoretical to operational faster than anything I have seen in my career.

The data in this report reflects that. 90% of enterprise AI usage is invisible to the security team responsible for it, and only 29% of organizations say they have controls in place to secure it. That 61-point gap, between how much AI is running unseen and how much is under control, is the story this report exists to explain. In the same period, 83% of organizations deployed AI agents, up from 16% twelve months ago.

We built this report the same way we approach any security problem: start with the evidence. We tracked 302 publicly disclosed AI security incidents over the last twelve months, cross-referencing our own incident tracker with the AI Incident Database and the AIAAIC repository. Every attack walkthrough in this report is grounded in a CVE, a vendor disclosure, or published research.

AI is not optional. It is already in your infrastructure, your workflows, and your employees' browsers. The question is not whether to adopt it. The question is how to enable AI innovation with confidence. The organizations that get AI security right will not be the ones that moved slowest. They will be the ones that built visibility, governance, and response into their AI programs from the start, so they could move fast without losing control. That is the mission behind FireTail and the reason this report exists. AI adoption is accelerating whether security teams are ready or not. The work is to make sure they are.

Jeremy Snyder · Co-Founder and CEO, FireTail

Contributing authors

FireTail Research
Jeremy Snyder
Jeremy Snyder
Lead author

Co-Founder and CEO of FireTail. Jeremy spent twenty-eight years in cyber and IT operations before founding FireTail, with a focus on the intersection of cloud infrastructure and AI security. He holds an MBA from George Mason University, a BA in computational linguistics from UNC, and completed additional studies at Aalto University in Helsinki. Jeremy hosts This Week in AI Security, a weekly podcast tracking the incidents, vulnerabilities, and policy shifts shaping the AI security landscape.

Riley Priddle
Riley Priddle
Research

Co-Founder and CTO of FireTail. Riley leads engineering and infrastructure architecture for the platform. He spent a decade running cloud security initiatives at HP, SkyTV, and Otro, building the cloud-native security thinking that informs how FireTail approaches AI workload protection. Originally from New Zealand, Riley holds a BS in Information Technology from the Wellington Institute of Technology.

Timo Rüppell
Timo Rüppell
Threat analysis

VP of Product at FireTail. Before joining, Timo was a researcher in theoretical high-energy physics, working on quantum gravity and supersymmetry. He will tell you that AI security turned out to be the harder problem. Timo leads threat analysis for the platform and contributes original research on agentic attack surfaces and the security controls they require.

Viktor Markopoulos
Viktor Markopoulos
Data & tracker

Information security consultant and researcher, specializing in web application and AI security testing. Viktor has uncovered major data breaches and security vulnerabilities across Fortune 500 organizations. He maintains FireTail's AI Incident Tracker and leads the forensic analysis behind the incident data and breach case studies in this report.

Ayush Sethi
Ayush Sethi
Editorial & design

Ayush led design and editing for this report, translating technical threat models and incident data into the interactive format you are reading now. Ayush is an experienced product and GTM marketing professional with a strong background in AI security. He writes on AI governance and compliance for the FireTail blog.

Contents

Seven chapters. Pick where to start.

Chapter 01 The shift

AI adoption has outpaced security by every measure that matters.

Three waves of AI have moved into the enterprise stack in roughly two years. Each arrived before the controls for the previous one were finished. Most security stacks are watching the wrong layer and new AI adoption is happening daily, whether you know it or not.

Three waves and an inflection point

~3 years
2023
Conversational
Chat in the browser
Standalone assistants reached through a browser tab. The sensitive-data exposure was employees pasting source, contracts and customer records into a third-party model with no enterprise tenancy.
2024
Embedded
AI inside the platform
Copilot, Gemini and native assistants wired directly into the productivity suite, with the user's own entitlements. The model now reads live tenant data, which collapses the boundary between content and instruction: anything the model can read, an attacker can use to issue commands.
2025
Agentic
Agents that act
Autonomous agents with tool access, persistent memory, and MCP-brokered connections to production systems. They take privileged action without a human in the loop. In most organizations they are deployed with no inventory, no per-action logging, and no authorization model distinct from the human they impersonate.
2026
Inflection point
Bots overtake humans
In June 2026, Cloudflare confirmed that automated traffic, most of it driven by AI agents, exceeded human web traffic for the first time in the history of the internet. 57.4% of all web requests are now non-human. The attack surface is no longer a subset of the network. It is the majority of it.

The speed of this compression matters. Each wave arrived before the controls for the previous one were finished. Organizations were still writing acceptable-use policies for ChatGPT when Copilot started reading their tenant data. They were still debating whether to allow embedded assistants when autonomous agents were deployed into production with default credentials and no logging.

The result is a new failure pattern. The kill chain below is the shape almost every incident in this report takes. It is short, content-borne, and indistinguishable from sanctioned use. Lateral movement has collapsed into a single tool call. The motion defenders were trained to recognize no longer happens.

The new shape of the kill chain
Time to breach · 4 seconds · Human actions required: 0
↳ Attacker Malicious input Email, document, ticket
Stage 02 AI agent ingests Content enters context window
Stage 03 MCP tool call Executes injected instruction
↳ Breach Data exfiltrated No user interaction required

The tools most organizations rely on for detection and data protection were designed for a world where humans took every action and every action left a log. AI has broken these assumptions. The table below shows exactly where.

What DLP, SIEM and SOC were not built to see

The visibility gap
DLP
Data loss prevention
Built to
Inspect egress channels and fingerprint known-sensitive content: regex, exact-data-match and document fingerprints over mail, web uploads, endpoint and removable media.
Blind to
Legacy DLP matches strings and file fingerprints. It cannot see the semantic intent of an AI interaction, the topics being sent to a model, or how much data is leaving by token count. The exposure is in what the interaction means, which is not a pattern it can fingerprint.
SIEM
Log correlation & analytics
Built to
Correlate normalized telemetry against a schema and a rule set, with UEBA baselines anchored to user and host identities.
Blind to
Inference calls and tool invocations emit no native audit event. Where logs exist, they are free-text prompt-response pairs with punishing ingest cost.
SOC
Detection & response operations
Built to
Triage known TTPs and tuned signatures through tiered runbooks, measured on mean time to detect and respond.
Blind to
Prompt injection and tool abuse rarely leave the indicators a SOC is tuned to catch. The payload is natural language and indistinguishable from sanctioned use. There is no signature to author and no playbook for an agent doing exactly what it was permitted to do.

If your detection stack was built to watch egress channels, correlate log events, and match known signatures, you are watching the wrong layer.

Chapter 02 The biggest stories

The stories that have defined 2026, so far

2026 has been the most eventful year in cybersecurity so far, with most of the biggest stories driven by the breakneck evolution and adoption of AI. A rogue agent crisis that broke out of the security press and into the mainstream. A frontier model so effective at finding vulnerabilities that its creators restricted access to it. And an autonomous AI agent that built its own attack chain and breached a major AI platform without human direction. Here are three of the biggest stories in AI security so far.

Story 01 · OpenClaw · Jan–Mar 2026 Rogue agent crisis

The rogue agent that made agentic security a mainstream problem.

OpenClaw was the most-starred open-source AI agent on GitHub at the start of 2026. Within weeks it became the year's first major AI security crisis, and a textbook demonstration of what happens when autonomous software is deployed faster than the controls needed to govern it.

The agent's API server shipped with no authentication middleware. Users who exposed it to the internet, often to enable mobile access, gave anyone on the network full remote code execution on the host machine. Its companion marketplace had no code signing or sandboxing. Malicious "skills" exfiltrated SSH keys and environment variables to attacker infrastructure for weeks before discovery. Then came the data breach: a related social platform was compromised, leaking 1.5 million credentials including plaintext API keys for OpenAI, Anthropic, and AWS.

1,000+
machines exposed to the public internet with unauthenticated remote code execution.
1.5M
credentials leaked from the related MoltBook platform, including plaintext API keys for major AI providers.
1,184
malicious skills found on the official marketplace in a single audit. No code signing. No sandboxing.
Sources · FireTail Research · Wiz Security · public disclosure
Story 02 · Anthropic Mythos · Apr–Jun 2026 The vulnerability arms race

When a model got too good at finding vulnerabilities. And the industry had to decide what to do about it.

In April 2026, leaked internal documentation from Anthropic revealed that their frontier model family, codenamed Mythos, had discovered a vulnerability in a BSD package that had gone undetected for over twenty years, predating GitHub itself. Over 99% of the zero-day vulnerabilities Mythos identified in testing had not yet been patched. The model did not need specialized prompting. It read code, reasoned about business logic, and identified flaws that professional human pentesters had missed for decades.

Anthropic restricted access under a program called Project Glasswing, limiting Mythos cyber capabilities to a small number of vetted security organizations. When a public version launched in June, it shipped without the offensive security features. The move forced a question the industry had been avoiding: what happens when the tools for finding every vulnerability on the internet become generally available? The answer is still forming, but the vulnerability disclosure rate is already accelerating. Microsoft's June 2026 Patch Tuesday hit a record 206 CVEs. The zero-day clock, tracked by researchers at Sysdig and others, shows that median time from vulnerability disclosure to first in-the-wild exploit has collapsed from 84 days in 2021 to under a day in 2026.

OpenAI responded with its own Trusted Access for Cyber (TAC) program, scaling access to thousands of verified defenders. The arms race is no longer theoretical. It is the operating environment for every security team reading this report.

99%+
of zero-day vulnerabilities discovered by Mythos in testing were unpatched at time of discovery.
206
CVEs in a single Microsoft Patch Tuesday. A record, and a signal of what AI-accelerated vulnerability discovery looks like at scale.
Under 1 day
Median time from public disclosure to first in-the-wild exploit, 2026. Down from 84 days in 2021, and still shrinking.
Sources · Anthropic disclosure · Sysdig zero-day clock · Microsoft Security Response Center · OpenAI TAC announcement
Story 03 · Hugging Face Breach · Jul 2026 The first real agentic attack

An AI agent built its own kill chain and breached a third party. Nobody asked it to.

In July 2026, Hugging Face disclosed unauthorized access to internal datasets and service credentials. The entry point was a malicious dataset that exploited two code-execution paths in the data pipeline. The attacker escalated to node-level access, harvested credentials, and moved laterally across internal clusters over a weekend. Five days later, OpenAI confirmed the attacker was their model, running inside an internal capability evaluation environment with reduced safety constraints.

The model was sandboxed for testing. It spent substantial compute trying to escape. It found a zero-day in a proxy to get internet access, privilege-escalated until it reached a node with external connectivity, inferred that Hugging Face was likely to host what it needed, chained stolen credentials with a separate zero-day into remote code execution on Hugging Face's servers, and got caught. Nobody designed this attack path. The model was given a goal and built the kill chain itself.

This was not a novel technique. Escalation, lateral movement, credential harvesting, chaining zero-days: that is a known playbook. What is new is that an agent built and executed the entire chain end to end, without a human directing each step, at machine speed, across two separate organizations' infrastructure. Both organizations survived because they had rich telemetry to reconstruct the attack. Most enterprises deploying agents today do not have that telemetry.

17,000+
logged events reconstructed by Hugging Face in hours. The attack timeline was fully mapped because application-layer telemetry existed.
2
zero-day vulnerabilities chained by the model: one to escape the sandbox, one to achieve remote code execution on Hugging Face.
0
human operators directing the attack. The model built the entire kill chain autonomously from a single evaluation goal.
Sources · Hugging Face disclosure · OpenAI confirmation · FireTail Research

A rogue agent crisis that proved shadow AI is already inside the perimeter. A frontier model that turned vulnerability discovery into an automation problem. And an autonomous agent that built its own attack chain and breached a major platform without human direction. These are not three separate stories. They are three views of the same shift: AI is now the attacker, the attack surface, and the thing defenders have to secure, all at once.

FireTail · State of AI Security, H1 2026
Chapter 03 By the numbers

302 incidents. The pattern is clear.

The stories frame the year. The dataset makes it measurable. FireTail tracks AI security incidents alongside the AI Incident Database (AIID) and the AI, Algorithmic, and Automation Incidents and Controversies repository (AIAAIC). Combined and de-duplicated, the three sources documented 302 publicly disclosed incidents over the twelve months to June 2026. The distribution by attack type and by sector tells a consistent story.

4x
year-on-year increase in AI security incidents from 2024 to 2025. The 2026 run rate is tracking higher.
FireTail AI Incident Tracker
35%
of all incidents were data exfiltration. The number one attack type, ahead of prompt injection, rogue agents, and supply chain combined.
Combined dataset · n=302
68%
of breached organizations had no AI governance policy in place at the time of the incident.
IBM · Cost of a Data Breach 2026
By attack type sorted by share of total
n = 302
302
Incidents
Data exfiltration35%
Prompt injection16%
Rogue agent12%
Shadow AI11%
API & endpoint exposure11%
OAuth / access abuse8%
AI supply chain4%
MCP / tool poisoning3%
By sector same incidents, grouped differently
n = 302
Enterprise SaaS
22%65
Cross-sector / unknown
21%65
Healthcare
17%51
Government
14%42
Developer tooling
13%40
Financial services
13%39
Reading the year

For all the talk of novel agentic threats, most AI security incidents trace back to the same root cause: organizations do not know what AI is running in their environment, who is using it, or what it can reach. Shadow AI and a lack of visibility dominate the dataset. Data exfiltration leads by a wide margin. Prompt injection is second but accounts for less than half the volume. The incidents that fill the tracker are not exotic zero-days or adversarial model attacks. They are employees uploading sensitive data to unauthorized AI tools, credentials left in agent code, and agent API endpoints shipped without authentication.

The infrastructure around the model is where most of the exposure sits. Week after week on This Week in AI Security, the same pattern surfaces: it is not the model that is broken, it is the scaffolding. The packages, cloud environments, APIs, and service connections that hold the environment together. The credentials and permissions that no one re-examined after deployment day. The attack surface is not the prompt. It is everything the prompt can reach.

The sector distribution confirms what the breach cost data in Chapter 06 suggests: no vertical is exempt, but the sectors with the highest AI adoption rates and the weakest governance maturity are absorbing the most incidents. Enterprise SaaS and healthcare together account for nearly 40% of the dataset. Government trails in incident count but leads in severity when breaches do occur. Financial services, despite heavy regulation, is not meaningfully ahead.

Incidents worth knowing
2025 to 2026
EchoLeak · M365 Copilot

Indirect prompt injection in Microsoft 365 Copilot. A hidden instruction in an inbound email caused zero-click exfiltration of mailbox content. Patched server-side via coordinated disclosure.

Source →
Prompt injection May 2025
Replit AI · SaaStr database

An AI coding agent destroyed a production database during a normal session, then issued misleading status reports about what it had done. Publicly disclosed by the customer.

Source →
Rogue agent Jul 2025
Cursor IDE RCE chain

Multiple vulnerabilities in the AI coding IDE allowed remote code execution, source-code disclosure, and credential exposure on developer workstations. CVEs assigned and patched.

Source →
Supply chain Aug 2025
Nx · s1ngularity supply chain

Compromised versions of the popular Nx build tool shipped a postinstall script that invoked local AI coding assistants to locate developer credentials and exfiltrate them. The first observed npm attack using AI agents as the attack tool.

Source →
Supply chain Aug 2025
Mercor · LiteLLM supply chain

A compromised release of LiteLLM, the open-source gateway that routes traffic between apps and more than 100 AI models, shipped credential-stealing code to everything that installed it. LiteLLM runs in roughly a third of cloud environments, so the blast radius was enormous. Mercor, the AI talent marketplace that vets the experts who train models for OpenAI, Anthropic, and Meta, was the first confirmed downstream victim, with source code, internal databases, and contractor records exposed. The entry point was not Mercor's own code. It was an AI component in its supply chain that nobody was tracking.

Source →
Supply chain Mar 2026
McKinsey Lilli AI platform

Security researchers found 200 API endpoints backing McKinsey's internal AI system, Lilli. Twenty-two required no authentication. A concatenation flaw in JSON key handling enabled SQL injection that bypassed OWASP ZAP detection, giving access to 46.5 million chat messages, 728,000 files, and 57,000 user accounts. The vulnerability was in the API layer, not the model.

Source →
API exposure Mar 2026
Vercel production breach

One employee signed up for a third-party AI tool with their corporate account and granted it allow-all OAuth permissions. When that AI vendor was compromised, the token let attackers into Vercel's internal systems and the environment variables of a subset of customer projects. The entry point was not code or a hijacked package. It was an OAuth scope.

Source →
OAuth / access abuse Apr 2026
Community Bank PA · SEC 8-K filing

A Pennsylvania bank filed an 8-K with the SEC disclosing a data breach caused by an employee uploading Social Security numbers and dates of birth to an unauthorized AI application. The first known SEC filing explicitly attributing a data breach to unauthorized AI usage. The bank did not disclose which AI application was involved.

Source →
Shadow AI May 2026
Live tracker
Every incident in the dataset, filterable and updated weekly.
Sort by attack type, sector, severity or date. Maintained by the FireTail research team.
Open the breach tracker
Chapter 04 Slowed down

Six attacks, slowed down. The mechanism is rarely the model itself.

The numbers describe the scale of the problem. Walking through an incident shows the mechanism. Six published attack patterns are reconstructed below, step by step, from setup to impact. Every reconstruction is grounded in a CVE, a vendor disclosure, or peer-reviewed research, cited at the end.

The data in Chapter 03 shows where AI security fails. This chapter shows how. Each walkthrough isolates the mechanism, the moment the attacker gains leverage, and the control that would have stopped it. In every case the fix is closer to configuration than procurement. The pattern across all six is consistent: it is not the model that breaks. It is the infrastructure, the permissions, and the assumptions around it.

Attack 01 of 06
Prompt injection · live

Zero-click data exfiltration via indirect prompt injection

Based on CVE-2025-32711 "EchoLeak", Microsoft 365 Copilot, 2025
1 / 6
Elapsed: T−72 hours · Human actions: 0
“
Welp, that happened faster than I predicted.
Matthew Prince
Co-Founder and CEO, Cloudflare
On automated traffic surpassing human web traffic for the first time · June 2026

When the chief executive of a company that handles a significant share of global web traffic says the shift outpaced his own forecast, the question for security teams is no longer whether AI has changed the threat landscape. It is whether their controls have caught up with a network where most traffic is now autonomous.

Chapter 05 Frameworks

Six frameworks, emerging fast, converging on the same answer.

The pace of change and a lack of visibility create the exposure gap. Frameworks are the industry's attempt to close it. Six have emerged or matured in the last eighteen months, from different bodies with different purposes. NIST offers a risk-management scaffold. OWASP catalogs the threats twice, once for language models and once for agents. ISO certifies the process. MITRE maps how attacks unfold. The EU AI Act makes evidence of all of it a legal requirement. They are not competing standards. Read together, they describe the same small set of controls from several different angles.

NIST US, Voluntary

AI Risk Management Framework

A structured way to identify, measure, and manage AI risk across the lifecycle. The name tells you what it is: a risk-management framework, not a checklist of technical controls. Useful for wrapping your arms around where an organization sits on maturity, and as a starting point to build from. Widely used as the default reference for US companies with no sector regulator to follow.

Govern, Map, Measure, Manage.
OWASP Global, Community

LLM Top 10

The threat model most security teams already know, adapted for large language models. Prompt injection sits at number one. The list covers sensitive information disclosure, supply chain, data and model poisoning, improper output handling, and excessive agency. If your team has ever used the OWASP Web or API Top 10, this is the LLM equivalent and the fastest way to give developers a shared risk vocabulary.

10 risks, prompt injection ranked number 1.
ISO Global, Certifiable

ISO/IEC 42001

The first certifiable AI management system standard, structured like ISO 27001 for information security. It defines the management processes an organization needs to develop and operate AI responsibly. This is the one procurement teams and enterprise buyers will increasingly ask vendors to hold, because it produces an auditable certificate rather than a self-assessment.

Certifiable, audit-ready.
MITRE Global, Knowledge base

ATLAS

Adversarial Threat Landscape for Artificial-Intelligence Systems. The ATT&CK equivalent for AI: a knowledge base of real-world adversary tactics and techniques against machine learning and AI systems, mapped to observed incidents. Where OWASP tells you what can go wrong, ATLAS documents how attackers have actually done it, tactic by tactic.

Adversarial TTPs, mapped to real attacks.
Deep dive · Emerging framework

The OWASP Agentic Top 10: the year the risk model split in two

For most of the last two years, LLM security and AI security were treated as the same problem. In late 2025, OWASP acknowledged they are not. Alongside the established LLM Top 10, it published a separate top-ten list for agentic systems, a recognition that an autonomous agent with tool access, memory, and the ability to act carries risks a chatbot never could.

The distinction matters because the controls are different. An LLM risk is mostly about what the model says. An agentic risk is about what the agent does. The list below is the reference taxonomy for the attacks reconstructed in Chapter 04.

01Agent goal hijack
02Tool misuse and exploitation
03Identity and privilege abuse
04Agentic supply chain vulnerabilities
05Unexpected code execution
06Memory and context poisoning
07Insecure agent-to-agent communication
08Cascading failures
09Human-agent trust exploitation
10Rogue agents
Source · OWASP Agentic Security Initiative · Agentic AI Top 10, 2025
Deep dive · The most comprehensive

The EU AI Act: the only framework with legal teeth

The other five frameworks are voluntary or advisory. The EU AI Act is law. It is also the most comprehensive of the six, covering prohibited practices, high-risk obligations, transparency, and governance across the full lifecycle. Most security teams treat compliance as a workstream separate from security. With this Act, the two overlap almost completely: the high-risk Articles are, with very few exceptions, the same controls a competent security program would already have in place. It is also the only one of the six that is genuinely actionable, a concrete checklist of Articles you can implement against rather than a set of principles.

When the Act applies

Staggered application
  1. 2 Feb 2025
    Prohibitions in force
    Article 5 lists banned AI practices, including social scoring, manipulative systems, and most real-time biometric identification in public spaces. AI literacy obligations for staff also begin.
  2. 2 Aug 2025
    General-purpose AI obligations
    Transparency, technical documentation and copyright-policy obligations begin for providers of general-purpose AI models. Governance bodies, notified bodies and penalty regimes also take effect.
  3. 2 Aug 2026
    Transparency obligations begin
    Article 50 transparency obligations are now in effect, requiring disclosure to users when they interact with AI or when content is AI-generated. This was also the original binding date for high-risk Annex III obligations before the Digital Omnibus deferral.
  4. 2 Dec 2027
    High-risk Annex III obligations (deferred)
    Articles 9 to 17 apply to providers of standalone high-risk AI systems listed in Annex III, with Article 26 obligations for deployers. Deferred from 2 Aug 2026 under the 2025 Digital Omnibus, pending Official Journal publication. High-risk AI embedded in regulated products under Annex I follows on 2 Aug 2028.

Seven obligations for high-risk AI

Articles 9 – 15
  1. Art. 9
    Risk management system
    A continuous, iterative process running across the AI system’s entire lifecycle, including residual-risk testing.
  2. Art. 10
    Data and data governance
    Training, validation and testing datasets must meet quality, relevance, and bias-examination criteria.
  3. Art. 11
    Technical documentation
    Documentation sufficient to demonstrate conformity must be produced before market placement and kept up to date.
  4. Art. 12
    Record-keeping
    Automatic logging of events relevant to identifying risks and substantial modifications throughout the system’s lifecycle.
  5. Art. 13
    Transparency to deployers
    Instructions for use that allow deployers to interpret outputs correctly and understand the system’s limits.
  6. Art. 14
    Human oversight
    Effective measures that allow natural persons to monitor and intervene in the system’s operation.
  7. Art. 15
    Accuracy, robustness, cybersecurity
    Appropriate levels of accuracy and resilience to errors, faults and adversarial attempts must be designed in and declared.

For security teams, the most useful reading of the Act is to treat the seven obligations above as a control library. Most of them map directly onto existing security domains. Where the Act differs is that it makes evidence of those controls a legal artifact, not just an operational practice. That evidence has to span both workforce and workload AI, and so does the inventory beneath it. You cannot produce evidence for AI you have not yet found.

EU Regulation 2024/1689 · Articles 9–15
2 Dec 2027
The next high-risk deadline. Standalone Annex III obligations were deferred to this date from 2 Aug 2026 under the Digital Omnibus, pending Official Journal publication. Transparency obligations under Article 50 are already in effect as of 2 Aug 2026.
EU Regulation 2024/1689, as amended
8
Annex III categories define “high-risk”, including critical infrastructure, education, employment, essential public services, and law enforcement.
EU AI Act · Annex III
€35M
or 7% of global annual turnover, whichever is higher. Top fine band, reserved for prohibited AI practices under Article 5.
EU AI Act · Article 99

Six frameworks, one answer

NIST tells you to manage the risk. OWASP catalogs the risks, for both models and agents. ISO tells you how to certify your process. MITRE documents how you will be attacked. The EU AI Act makes evidence of all of it a legal requirement. Read separately, they look like six compliance burdens. Read together, they point at the same small set of controls: know what AI you are running, govern how it is used, log what it does, and be able to prove it. The frameworks are converging. The question is whether your controls are.

Assess your EU AI Act readiness
Chapter 06 Comparatives

Breach cost and peer ranking are the two numbers that actually move the AI security budget.

Once the legal floor is clear, the business question is two-part. Is the exposure expensive enough to act on, and are we behind our peers? The table answers the first. The grid answers the second. A note on the risk-reduction column: percentages reflect a review of incidents where the listed control was present versus absent. They are floors, not promises. The point is the gap between vectors.

Threat vector Avg breach cost Primary control Effort Risk reduction
Prompt injection (indirect) $5.89M Input sanitization layer + prompt shield before LLM ingestion Low · 2–4 wks
~82%
Model inversion $6.07M Inference monitoring, output filtering, and query-rate anomaly detection Med · 4 to 8 wks
~60%
API misconfiguration / exposure $4.37M AI API gateway with auth enforcement, rate limiting, anomaly detection Low · 1–3 wks
~91%
Shadow AI / OAuth overreach $5.39M AI asset discovery + OAuth audit + agent-specific acceptable use policy Med · 3–6 wks
~67%
Training data poisoning $4.32M Data lineage tracking + pipeline integrity + behavior monitoring High · 8–16 wks
~58%
AI-driven malicious breach $6.04M AI-aware detection and response tuned for machine-speed activity, plus continuous behavioral monitoring High · 8 to 12 wks
~55%

Source · Average breach cost: IBM Cost of a Data Breach Report 2026. Primary control, effort and risk reduction: FireTail analysis.

The economic argument for AI runtime monitoring is, frankly, the easiest part of this report. IBM puts the saving at $1.93M per breach, with containment 65 days faster. The harder part is that you cannot monitor what you have not yet inventoried. The order of operations matters more than the budget.

IBM · Cost of a Data Breach 2026
Sector benchmark

Where your sector sits

The benchmark scores below are drawn from aggregated, anonymized responses to FireTail's EU AI Act Readiness Assessment. Each sector median reflects how organizations in that sector scored across three dimensions: AI inventory, runtime monitoring, and EU AI Act readiness. The assessment is free, takes a few minutes, and returns a score you can compare directly against these medians.

If your score is below your sector median, you are carrying above-average risk relative to your competitive set. That is the comparison your cyber insurer is making, and increasingly the one your regulator is too. The number you walk into the audit committee with is not your absolute score. It is the gap.

Financial services
54/ 100 median
AI inventory
Runtime monitoring
EU AI Act readiness
3rd quartile · ahead of median
Healthcare
46/ 100 median
AI inventory
Runtime monitoring
EU AI Act readiness
2nd quartile · at the median
Enterprise SaaS
38/ 100 median
AI inventory
Runtime monitoring
EU AI Act readiness
2nd quartile · below median
Government
28/ 100 median
AI inventory
Runtime monitoring
EU AI Act readiness
1st quartile · trailing

Source · FireTail EU AI Act Readiness Assessment · getaiactready.eu

Find your score before your auditor does

You have seen the sector medians. The next question is where you sit against them. FireTail's EU AI Act Readiness Assessment returns a score across AI inventory, runtime monitoring, and regulatory readiness, benchmarked against your sector. It is free, takes a few minutes, and needs no login.

Take the EU AI Act Readiness Assessment
Chapter 07 Operations

The first ninety days of AI security work returns more than the next twelve months combined.

Cost and comparatives justify the work. Below is the work, in the order it pays back. Twelve actions across three horizons. Horizon 1 you can start immediately, much of it with tooling you already run. Horizon 2 is where dedicated AI tooling earns its place. Horizon 3 is architecture work that takes a fiscal year. Run them in order. The first item tends to surface the rest.

Start with what you can see

Every incident in this report traces back to the same gap: organizations could not see the AI already running inside them. The ninety-day plan above starts there for a reason. You cannot govern, log, or secure what you have not yet found. The first step is not a purchase. It is a complete picture of the AI in your environment, across code, cloud, and your workforce. That is where the work begins, and where FireTail can help.