Organisations across industries say the rapid pace of AI transformation is now their biggest security challenge, according to new research from Thales.

According to the firm’s latest threat report, 70% of organisations cite AI as their top data security risk, across markets such as automotive, energy, finance, and retail.

The concern is not only about malicious AI, but about the access it is being granted as it shifts from a tool to a trusted insider.

As enterprises embed AI into workflows, analytics, customer service, and development pipelines, these systems are being granted broad, automated access to enterprise data, often with fewer controls than those applied to human users in a corporate environment.

“Insider risk is no longer just about people. It is also about automated systems that have been trusted too quickly,” says Sebastien Cano, Senior Vice President, Cybersecurity Products at Thales. “When identity governance, access policies, or encryption are weak, AI can amplify those weaknesses across corporate environments far faster than any human ever could.”

Visibility Gaps Widen As AI Expands Data Reach

The report reveals a troubling disconnect between AI adoption and data control. Only 34% of organisations know where all their data resides, whatever the level of criticality, and just 39% can fully classify it. Meanwhile, nearly half (47%) of sensitive cloud data remains unencrypted.

As AI systems ingest and act on data across cloud and SaaS environments, limited visibility makes enforcing least-privilege access increasingly difficult, that is granting only the strictly necessary access rights. This increases the extent of exposure if credentials are compromised.

Identity infrastructure is now the primary attack surface. Credential theft remains the leading attack technique against cloud management infrastructure, cited by 67% of organisations experiencing cloud attacks.

At the same time, 50% rank secrets management among their top application security challenges, reflecting the growing complexity of governing machine identities, API (interfaces de programmation applicative) keys, and tokens at scale.

AI Powers More Convincing Attacks

While organisations race to adopt AI, attackers are doing the same. Nearly 60% of companies report experiencing deepfake-driven attacks, and 48% report reputational damage tied to AI-generated misinformation or impersonation campaigns.

As AI introduces new risks, it also increases existing ones. Human error already contributes to 28% of breaches, and with automation layered on top, small mistakes can scale faster and spread wider.

Recommended reading

• Europe’s AI Security Controls Lag As Attack Surfaces Expand
• 92% of Enterprise Devices Unprepared for AI Security Challenges
• Over 1 in 10 Business Leaders Don’t Know if They’ve Been Hacked

Security Investment Shifts

While organisations recognize the need to adapt, investment is not keeping pace with the rapid expansion of AI-driven access and automation. 30% now dedicate specific budgets to AI security, reflecting growing awareness.

However, the majority (53%) still depend on traditional security programs built primarily for human users and perimeter-based controls. As machines increasingly authenticate, access, and act autonomously, many security strategies have yet to adjust to this shift in operating models.

“As AI becomes deeply embedded into enterprise operations, continuous data visibility and protection are no longer optional,” said Eric Hanselman, Chief Analyst at S&P Global 451 Research.

“Organisations must treat data security strategy as foundational to innovation, not separate from it.”

Evolving Trust

AI is not replacing traditional threats; rather, it is intensifying them by increasing their speed, scale, and reach.

As automated systems gain broader access to enterprise data, organisations must rethink identity, encryption, and data visibility as core infrastructure. The organisations that embed strong governance into their AI strategies will be better positioned to innovate securely and avoid turning AI into their newest insider threat.