Artificial intelligence (AI) risks have evolved significantly over the past year. Reports of OpenAI and Anthropic agents acting autonomously continue to unfold, igniting a development slowdown debate amid heightened security concerns. Organizations will need to address the state of their own AI security for 2027, but preparations begin now.
Organizations spent 2026 deploying AI at record speeds across operations. Top executives pushed for new innovations and urged employees to use them. Now organizations must prove they can govern, secure, and benefit from AI – a task that may be more difficult than simply implementing it.
As organizations enter an era of AI, security teams will need to proactively work across departments to be enablers of secure AI adoption, explains Melinda Marks, practice director of cybersecurity at Omdia. That includes “steps to best manage and protect data, set policies and guardrails for secure access and usage, and secure the software supply chain as it complexity increases," Marks tells Dark Reading.
Between governance, security, identity, budget constraints, and supply chain risks, enterprises are facing challenges from all angles. With three months of 2026 left to go, Gartner and Omdia released predictions and recommendations based on an evolving landscape that's heavily influenced by AI advancements.
AI: Prove Your Worth
AI has flooded the market over the past few years. Some tools proved genuinely useful, while others were considered "hype". Security teams automated incident response protocols and threat detection to save time and reduce alert fatigue. But supply chain and shadow AI risks arose as employees used unsanctioned tools, while AI development began outpacing the establishment of proper guardrails.
After pouring trillions of dollars into AI throughout 2026—testing new tools and use cases aimed at improving productivity, organizations face a potentially more daunting challenge. They must prove the technology's worth. Omdia and Gartner agree that the question now revolves around how organizations can shift from deployment to demonstrating value.
Growing budgets will intensify those pressures. Omdia found that 59% of organizations expect their AI budgets to increase by 10% or more next year, according to a press release on "Four forces set to reshape technology in 2027".
The technology research and advisory group said success in the coming year will be measured by return on investment (ROIs) and productivity gains, not just technical superiority. To that end, organizations must develop metrics to track ROIs and understand that currency is shifting to more "consumption-based and token-driven economies" that may be more expensive than they realize.
Gartner is on the same page. Analysts from the advisory group recommended that chief information security officers (CISOs) focus on proving AI's security value by moving beyond the hype to infrastructure protection and governance.
The latter is particularly critical. Agents are already acting autonomously, so the issue is no longer theoretical. But more than half of organizations aren't prepared. Gartner analysts shared a stark statistic taken from a 2026 report; fifty-four percent of organizations had no defined approach to limit AI agent access.
As the year winds down and risks materialize for companies lacking agent control, this issue will become a critical focus heading into 2027. Gartner urged CISOs to govern autonomous multiagent systems based on action privileges, ensuring they have control of their agents to reduce blast radiuses if things do go awry.
"An AI system does not need to achieve artificial general intelligence capabilities to create significant cyber risk," Gartner wrote in the press release. "It simply needs the ability to impact enterprise operations."
Prevention Over Reaction
While Gartner's guidance is action to be taken in the last three months of 2026 and Omdia's advice is geared toward 2027, both believe that reactive approaches to address immediate AI risks is no longer viable.
Gartner laid it out in terms of combating deepfake threats. The threat is now considered "mainstream," warned Gartner.
While these rendered videos have been tricking users for years, AI advancements have only made it harder to decipher if the person behind the camera is legitimate. Threat actors, including nation-states, use deepfakes to apply for jobs, elicit money by posing as a top executive, or as IT attempting to steal employee credentials.
Organizations must redesign the whole recognition process. A multilayered approach should combine deepfake detection technology with contextual signals such as device location or IP address, recommended Gartner.
Preemptive approaches must be applied to vulnerability management, as well. One 2026 Gartner survey found that 76% of CISOs ranked AI-driven vulnerability discovery among their top 10 emerging risks.
Whether AI is actually helping attackers exploit more vulnerabilities is not entirely clear, but patch management is on top of CISOs' minds either way. Automating moving target defense, advanced obfuscation, deception, and predicative threat intelligence could help organizations gain a defensive advantage, recommended Gartner.
Omdia raised reactive strategy concerns regarding supply chain risks, especially as AI moves from the screen into the physical world through robotic infrastructure and connected environments. Proving AI's value becomes even harder when the foundation itself is compromised.
Organizations faced an onslaught of supply chain compromises in 2026, particularly against open-source components and GitHub repositories that cast large downstream nets. The cybercriminal group known as TeamPCP was highly active in these types of threats, conducting attacks targeting Litellm package versions many organizations use to build AI-powered applications, that led to widespread credential theft.
Omdia warned that "technology companies can no longer assume disruption will end and supply chains will return to normal." That's where a focus on resilience and having a plan on how to resume operations becomes critical to give companies a competitive edge, retain customer trust, and reduce financial losses.