Most Organisations Can’t See Their AI Traffic and Attackers Are Already Exploiting That

Key Takeaways

• Only 5% of firms see AI tool usage and data flows
• 78% have experienced or suspect AI‑related security incidents this year
• Only 24% can inspect AI traffic without performance loss; 76% cannot
• Just 14% enforce and audit AI security policies enterprise‑wide
• 45% document AI policies, yet 42% of employees bypass them

Pulse Analysis

The Check Point 2026 Cloud Security Report underscores a widening security chasm as AI moves from pilot projects to production at scale. Surveyed IT and cybersecurity leaders report that while three‑quarters have revised their security strategies for AI, a mere quarter have the underlying architecture to enforce those policies. This mismatch creates a visibility crisis: only five percent of organizations can map which generative AI tools employees use, what data they ingest, and where that data travels. Consequently, more than three‑quarters of respondents have either confirmed or suspect AI‑related breaches, ranging from shadow AI deployments to deep‑fake phishing campaigns.

Technical shortcomings compound the problem. Traditional network and application security stacks were engineered for human‑initiated traffic, predictable SaaS patterns, and static workloads. AI workloads, by contrast, generate massive API traffic, operate autonomously, and demand real‑time inspection without degrading performance. The report finds that just 24% of firms can fully inspect AI traffic without slowing applications, while 71% see a surge in false positives from web‑application firewalls tuned for human traffic. Runtime controls such as prompt validation and output filtering are deployed by only 17% of enterprises, and a staggering 56% lack formal testing for generative‑AI applications. These gaps leave organizations able to detect risk but largely unable to prevent it.

The findings translate into a clear call to action for security leaders. Building an AI asset inventory, enforcing unified policies across hybrid environments, and integrating AI‑specific DLP and runtime controls are essential steps. More importantly, organizations must redesign their security architecture to treat AI traffic as a first‑class citizen—embedding visibility, control, and enforcement at the infrastructure, cloud, and endpoint layers. Companies that adopt a holistic, policy‑driven model will not only mitigate immediate threats but also position themselves for sustainable AI innovation in a rapidly evolving threat landscape.