# AI Governance Gaps Increase Cybersecurity Risks and Costs for Firms

> The rapid adoption of AI in business is outpacing the necessary governance, exposing organizations to substantial risks. As highlighted by Bryan Barrett, without proper oversight, the promise of AI could turn into peril.

**Source**: munichre.com | **Published**: 2026-10-15 | **Type**: article

## Key Facts

- 68% of breached firms lack AI governance, exposing them to operational and legal risks.
- AI-driven attacks rose 56%, costing $1M more than traditional breaches, highlighting urgent defenses.
- Only 36% use AI in security, revealing a competitive vulnerability in breach response efficiency.
- Average breach costs in the U.S. hit $11.5M, indicating rising financial stakes for cybersecurity.
- Proactive governance can reduce breach costs by $1.93M, underscoring strategic risk management benefits.

## Summary

Organizations across various sectors are increasingly integrating artificial intelligence (AI) into their operations, leading to significant improvements in productivity and efficiency. However, this rapid adoption is outpacing the development of necessary governance and risk management frameworks, creating substantial vulnerabilities. Bryan Barrett, Regional Underwriting Manager for Cyber and Technology Errors & Omissions at Munich Re Specialty – North America, highlights that while companies are eager to harness AI's potential, they often neglect the critical oversight required to mitigate operational, financial, and legal risks.

The gap in AI governance is becoming more pronounced. According to IBM's 2026 Cost of a Data Breach Report, 68% of organizations that experienced a data breach lacked formal AI governance policies, while 33% reported that their policies were still in development. Alarmingly, 92% of these organizations did not have adequate access controls for AI systems. This oversight can lead to severe consequences, including data loss and regulatory penalties. As companies rush to implement AI, they often overlook the complexities involved in managing these systems, which do not operate under the predictable rules of traditional software.

The cybersecurity landscape is shifting as threat actors leverage AI to enhance their attacks. Barrett notes that organizations are witnessing a rise in cyberattacks that utilize AI, which allows attackers to operate more efficiently and stealthily. IBM's report indicates that over 25% of organizations faced AI-driven attacks, marking a 56% increase from the previous year. Deepfake impersonation attacks accounted for 45% of these incidents, illustrating how AI is transforming the nature of cyber threats. The average cost of an AI-driven cyberattack is now $1 million higher than that of traditional breaches, underscoring the financial implications of these evolving threats.

As organizations adopt AI, they must also contend with the risk of their AI systems becoming targets for cybercriminals. Techniques such as data poisoning can compromise AI models, necessitating extensive forensic reviews and retraining efforts. This highlights the importance of a robust governance framework that not only addresses deployment and usage but also ensures accountability and continuous monitoring as AI technologies evolve. Employee education is equally critical, as many attacks exploit human vulnerabilities through increasingly sophisticated phishing and social engineering tactics.

To navigate this complex landscape, organizations must shift from a reactive to a proactive security model. Barrett emphasizes the need for a comprehensive approach that includes adopting zero-trust security principles, investing in tools to identify anomalous behaviors, and implementing strong AI governance programs. The financial stakes are high, with the global average cost of a data breach rising to $4.99 million, and $11.5 million in the United States. However, organizations that effectively integrate AI into their security operations can reduce breach costs significantly, highlighting the dual role of AI as both a potential risk and a defensive asset.

Munich Re Specialty has recognized the need for expert guidance in this area and has partnered with CyRisk to develop an AI module for its Reflex™ Cyber Risk Management program. This initiative aims to help organizations understand and manage AI-related risks proactively, ensuring they can leverage AI's benefits while minimizing security and regulatory exposures. The lessons learned from past technological shifts, such as cloud adoption and digital transformation, suggest that organizations must prioritize governance alongside innovation. Those that embed security and oversight into their AI strategies will be better positioned to harness its advantages while effectively managing the associated risks.

As AI continues to reshape the business landscape, the imperative for a balanced approach to innovation and risk management becomes clearer. Organizations must act swiftly to enhance their governance frameworks and cybersecurity measures, ensuring they can navigate the complexities of AI adoption without compromising their operational integrity. The future will favor those who can integrate AI responsibly, turning potential vulnerabilities into strategic advantages.

## Entities

- **Companies**: Munich Re Specialty, IBM, CyRisk
- **Products**: Reflex™ Cyber Risk Management program
- **Technologies**: artificial intelligence, deepfakes
- **People**: Bryan Barrett

## Key Concepts

AI governance gap, cybersecurity, risk management, zero-trust security, employee education, AI-driven attacks, shadow AI, data poisoning

## Definitions

- **AI governance gap**: The disparity between the rapid adoption of AI technologies and the slower development of governance and oversight policies.
- **shadow AI**: The unauthorized use of AI tools or applications by employees without IT department approval.
- **zero-trust security**: A security model that requires verification for every user and device attempting to access resources, regardless of their location.
- **data poisoning**: A technique where malicious data is introduced to an AI model to influence its outputs and behavior.
- **deepfakes**: Synthetic media where a person in an existing image or video is replaced with someone else's likeness, often used for impersonation.

## Use Cases

- AI in customer service
- AI in operations
- AI in software development
- AI in risk analysis
- AI in decision making
- AI risk management consulting

## Frequently Asked Questions

**What is the AI governance gap?**

The AI governance gap refers to the lag in governance and oversight policies compared to the rapid implementation of AI technologies in organizations. This gap can lead to increased operational and legal risks.

**How can organizations mitigate AI-related risks?**

Organizations can mitigate AI-related risks by establishing strong governance frameworks, implementing zero-trust security principles, and providing ongoing employee education on potential threats like phishing and social engineering.

**What role does employee education play in AI security?**

Employee education is critical in AI security as many attacks exploit human behavior. Training employees to recognize advanced phishing and social engineering threats can significantly reduce the risk of successful attacks.

**What are the financial implications of AI-related breaches?**

AI-related breaches can be significantly more costly than traditional breaches, with an average cost increase of $1 million. Organizations that effectively use AI in their security operations can reduce breach costs and improve response times.

**What is the Reflex™ Cyber Risk Management program?**

The Reflex™ Cyber Risk Management program is a service developed by Munich Re Specialty in partnership with CyRisk, aimed at helping organizations manage AI-related risks through consulting on strategy, governance, and security practices.

## Links

- [Read on Welcome.AI](https://welcome.ai/content/ai-governance-gaps-increase-cybersecurity-risks-and-costs-for-firms)
- [Original source](https://www.munichre.com/specialty/en/insights/cyber-and-technology/na/ai-beyond-the-boardroom-turning-innovation-into-resilience.html)

---

Source: Welcome.AI | https://welcome.ai/content/ai-governance-gaps-increase-cybersecurity-risks-and-costs-for-firms