What happened
An October report from PwC, based on a survey of more than 3,900 business and technology leaders across 71 countries, found that companies feel least ready to defend against attacks aimed at their AI systems. Half of the security leaders surveyed named protecting AI as their single largest preparedness gap, ahead of cloud security, third party breaches, and ransomware.
The same research points to a governance problem rather than a purely technical one. There is no settled ownership model for AI risk. Less than 30 percent of AI accountability sits with CIOs, CTOs, or other technology leaders, about one quarter of organizations have a dedicated AI executive, and 17 percent said accountability rests with the CISO. As one PwC leader put it, AI opportunity and AI risk have to be considered together.
The findings cover three recurring problem areas: agentic tools that are given broad access with too little oversight, third party AI products that hold privileged access with limited visibility, and shadow AI, meaning unsanctioned tools employees adopt on their own. A KPMG report cited in the article found that 49 percent of organizations now restrict agent access in high risk scenarios, up from 28 percent a year earlier.
Why this is a GRC story
Unclear ownership is the root issue. If nobody can say who owns AI risk, then nobody is accountable for the controls around it. The PwC numbers sketch an organization where AI adoption has outrun the assignment of responsibility, which is the classic gap that governance frameworks exist to close. Work on that starts with a decision, not a tool: name an owner, and give that owner the authority to set rules.
Agents are identities, and they inherit access. The article quotes a security officer who advises treating every agent as a new identity with a named human owner, because an agent runs with the access of whoever deploys it. That single idea connects AI governance to identity and access management, where most organizations already have a process. Extending it to agents is a manageable step.
Third party and shadow AI are familiar risks in new clothes. Vetting an AI vendor is vendor due diligence. Discovering unsanctioned AI tools is the same visibility problem that shadow IT posed for years. Framing these under existing programs is faster than standing up something new.
What to watch
Watch whether boards start asking for the same evidence on AI that they already ask for on cyber risk: a register, an owner, and a reporting cadence. Watch, too, for regulators picking up the theme, and for standards work that gives organizations a common way to describe AI controls.
The practical starting point is small and cheap. Pick one AI use case in your organization, write down who owns it, what data and systems it can reach, and who reviews it. That exercise usually exposes the ownership gap in about an hour. Doing it once, honestly, tells you more than another survey result.
Attribution: Analysis based on Cybersecurity Dive and the PwC and KPMG research it cites. This article is original commentary, not a repost of the source material.