Security is the Gate on Enterprise AI

TL;DR: Over the past few months, vulnerabilities and breaches due to AI have risen significantly including last week’s PHP exploitation attempts and July’s Hugging Face breach. We surveyed 50 senior enterprise security leaders about what this means and what stands between them and shipping AI.

• Security is now a condition for deploying AI. 84% of the security leaders we surveyed have had an AI initiative delayed, blocked or cancelled over security concerns. Two-thirds are funding the fix with net-new budget, and in about four in ten organizations, the security leader does not hold the budget for AI-native categories.
• Foundation models alone will not close the gap. In no category did more than 31% of respondents say a model could replace a specialist. Buyers need a control plane around the model, which no single model vendor can provide on behalf of its competitors.
• Incumbents win on distribution, but buyers remain open to new vendors. 62% signed at least one early-stage security vendor in the past two years. Only 19% stop evaluating when an incumbent ships a “good enough” feature, and just 7% have walked away from a purchase to wait for an incumbent. Startups win when they are materially better, deploy without moving customer data, and fill a gap rather than overlap with existing spend.
• The opportunity is to build the reason an AI project ships. We see openings in offensive security, agent containment on the endpoint, AI governance, non-human identity and the AI-native SOC.

In July 2026, Hugging Face disclosed that its production infrastructure had been breached by an autonomous AI agent system running end-to-end without a human at the keyboard. Five days later, OpenAI confirmed the agents were its own models, running with reduced refusals during an internal cyber-capability evaluation. Roughly a third of Hugging Face’s infrastructure had to be rebuilt.

The breach landed on top of fears that were already building across the security community. Anthropic had also recently introduced Claude Mythos Preview and declined to release it publicly, citing its cybersecurity capabilities. The UK AI Safety Institute concluded the model could autonomously attack small, weakly defended enterprise systems once it had network access. PwC’s perspective was that the model served as a leading indicator: the window between a vulnerability becoming known and becoming exploited is compressing, and slow remediation is now a business risk. As the months have passed, tens of thousands of security incidents have surfaced, including last week’s significant PHP vulnerabilities, which underscored how AI is accelerating the discovery and potential exploitation of critical flaws that could impact nearly 70% of all websites.

We fielded this survey (full survey results below) in August 2026, a few weeks after the original reported incidents: 50 senior security leaders, mostly at organizations of 1,000 to 50,000 employees. We asked what is actually stopping them from shipping AI, what they have already done to fix these issues, what functionalities the foundation model platforms could cover and ultimately what is the opportunity for next-gen vendors.

Have AI initiatives been delayed, blocked or cancelled because of security concerns?

In order to frame our discussion with buyers, we wanted to understand how real of an issue cybersecurity is and if it actually slowed the deployment of AI in practice.

Four in five said that there were real delays or cancellations in their AI initiatives, which shifts security from being a concern raised during an AI project to a condition for deploying AI at all.

As a result, two-thirds of respondents secured net-new budget specifically for AI-related security rather than cannibalizing an existing line, and the AI-native share of tooling spend is now near 10% and we expect it to roughly double within two years, growing several times faster than the other security budgets.

This budget also often sits outside of the security organization entirely, and instead with central AI programs, IT, the business unit, or absorbed directly into an existing model agreement. The person signing for security platforms may not even be the CISO.

What is actually blocking deployment?

The conversation since the OpenAI/Hugging Face and Anthropic news has been about securing autonomous agents including identity, runtime governance and containment; however, the constraint our respondents describe seems to sit upstream of the agent, before anything runs autonomously at all.

What is slowing AI deployment

What is currently preventing or slowing AI deployment from a security, governance or data-protection standpoint? Select up to 3.

By Hugging Face’s own account, the intrusion began in the data-processing pipeline. A malicious dataset abused two code-execution paths, escalated to node access and harvested credentials from there. The most advanced AI attack yet documented entered through the same layer our respondents say is blocking them from deploying AI at all, which likely drives the priority.

What do enterprises require to deploy AI?

We asked what had to be in place before AI could go live, then which of those they actually bought rather than covered with tooling they already owned. The broader the gap, the higher likelihood that enterprises cover the need with existing tooling.

Required before go-live vs. purchased net-new

Audit logging converts best with roughly three in four organizations buying something new if they had it required. Gateways and prompt-level data controls followed. Data classification converted at about half: a real market, but plenty of enterprises already own a tool they can point at it. Identity runs the other way. Half of respondents required agent identity and permissions before go-live and only one in eight bought anything new, because existing IAM absorbs the requirement while agent populations are small and supervised. Our expectation is that the need for net new identity platforms will expand as the number of agents running in production explodes over the coming years.

What types of AI-related incidents have enterprises faced?

Where the incidents show up most clearly is in how enterprises think about threat response. 

Response to AI-related threats in the past 12 months (share of responses)

AI-generated phishing attacks are observed constantly and changes very little as existing email security currently absorbs most of the response. AI-accelerated exploit development including prompt injection is the reverse: it is observed less but has moved controls and sent buyers to look for solutions. Security buyers appear to be buying against threats they expect rather than attacks they have actually suffered.

Which platforms are capturing the budget?

Buyers can source these capabilities from legacy incumbents, cloud service providers, foundation model vendors and next-gen specialists, and their choices varied.

Where deployed AI capability came from (select all that apply)

Two-thirds got their deployed AI capability from security vendors they already used, half from cloud and infrastructure vendors they already used. AI-native specialists came fourth, behind the enterprises’ own engineers. One in six said an internal build had replaced or deferred a commercial purchase outright. Buyer’s approach depends highly on the end use case they’re looking to solve, and they have their choice of how to address.

Which categories do the models eat?

Building AI capabilities internally on foundation models is becoming a standard choice, as shown above. As such, we wanted to unpack whether a frontier model, including OpenAI and Anthropic, is capable of addressing specific needs across categories as this becomes more mainstream. 

Could a foundation model handle this without a specialist?

No area came close to a majority saying a model could handle it alone. Foundation model platforms sell the model, but the model is only a part of what a security buyer needs. Buyers also need a control plane around the model: an enforcement point that can stop a flow before it ever reaches a prompt, a record of what was allowed and who approved it, and an authorization layer for agents that works across whichever providers the enterprise happens to run. 

No single model vendor can currently issue that record or that permission on behalf of its competitors, and none of them will deploy inside a customer’s tenant on the customer’s terms, which is what buyers told us they require. Products built at that layer do benefit as models improve, because every capability gain adds more autonomous activity that somebody has to govern, prove and contain.

So when does a startup actually win across security?

Startups are a critically important part of the security ecosystem as each technological shift has driven a new class of platforms to address the latest security threats. The procurement of startups won’t stop; however, the bar is high for buyers and that is shown in the data.

Early-stage vendors procured over past 2 years

How many vendors has your organization procured in the past 24 months that were, at the time of signing, early-stage, broadly Series A or B, or fewer than 100 customers?

62% of respondents procured at least one early-stage security vendor in the past 24 months, independent of AI-specific capabilities. Legacy platforms hold a meaningful distribution advantage, but it has not prevented buyers from adopting newer entrants.

We also asked how buyers respond when an existing platform vendor releases a capability that is adequate but not best-in-class, since that is the situation most challengers face when competing for an account.

Response when a platform vendor ships an adequate capability

When a platform vendor you already use ships a capability that is adequate but not best-in-class, what does your organization typically do?

Only 19% stop evaluating alternatives. 80% will keep a point tool or run a competitive evaluation, but the quality of the platform is what drives the change. A meaningfully better startup gets procured, but a marginally better one loses to the thing already on the invoice.

So what stops these purchases? These are the objections that have actually stopped a purchase from an AI-native vendor in the past two years.

What actually blocked or killed a startup purchase recently

Survey findings indicate incumbents are winning on distribution and inertia, not preference. Only 7% have killed a deal to wait for an incumbent to ship the same feature. Cross-team approval blocked just a few, which surprised us. The buying center for this spend has widened considerably, but it is still not where deals die.

What has stopped purchases is concentrated and mostly addressable. Data residency and privacy is an architectural decision that startups need to take seriously. Unproven efficacy and vendor viability are solved with reference customers and a balance sheet. Overlap with existing spend is positioning and is the penalty for selling into a category the buyer already funds rather than into a gap.

The conditions for a new vendor win

Reading the procurement data together, a startup gets bought when most of these are true:

• The product gap is material, not marginal. 80% of buyers will run a competitive evaluation or keep a point tool, but only against a meaningful difference in quality.
• It maps to new budget, not a renewal. Two-thirds of AI-security funding is net-new, and about half of incremental dollars are earmarked for categories with no incumbent at all.
• It deploys without moving customer data. The most common reason a deal stalls, and the one decided at founding rather than in the sales cycle.
• It does not overlap something already on the invoice. A quarter of respondents said overlap with existing spend had stopped a purchase.
• Efficacy is demonstrable, not asserted. Buyers told us a hands-on proof of concept in their own environment is what they actually require before signing.

Which security categories are gaining the most interest?

Buyer activity by category

Buyers are in a constant state of managing their incumbents, evaluating fresh alternatives and changing vendors to materially better platforms. Across categories, we see a range of activity; however, what is clear is that evaluations are ongoing across the stack.

Implications for Investment Areas

As we monitor these developments, there are a handful of thematic areas (in no order of priority) in which we’re excited to back the next generation of founders.

Offensive Security & Vulnerability Management

The time between a vulnerability becoming known and becoming exploited is collapsing to days while vulnerability management is still organized around following due process with a scan-and-remediate cadence. Attackers capture the benefit of model progress first, since finding and exploiting is a generative task while defending is an operational one, so incumbent scanners from legacy platforms like Tenable, Qualys and Rapid7 don’t cut it. It is also the category where incumbency helps least, with the lowest vendor loyalty and the most active evaluations, per our data. Products get judged on what they find in the customer’s environment and that is the exciting part for a founder. Upstart vendors that surface real findings in live environments can take the account on a single evaluation rather than waiting for a replacement cycle. 

Endpoint Security

Mature categories including endpoint are dominated by renewal without evaluation and EDR from CrowdStrike, SentinelOne and Microsoft Defender is often the most entrenched line on the invoice. What is changing is what runs on the device, as local models, agent runtimes and copilots now execute code, reach files and call external services using the user’s credentials and without the user watching. The opportunity is the layer that governs what an agent on the device is allowed to touch and produces the record of what it did, rather than the entire EDR suite. Framing the net new platform as a full endpoint replacement likely won’t be positioned well in the early days; however, startups approaching the issue of agent containment on the last mile is selling into AI-native budget with no incumbent in it.

AI Governance

Governance is what buyers name when asked what is slowing them down, with legal review and regulatory uncertainty tied for third among deployment blockers behind only unclassified data and residency. Model inventory, use-case intake, risk classification, approval workflow and policy mapping against regulations and internal standards are being rebuilt in spreadsheets at every enterprise we speak to. The buyer is also new, because this budget frequently sits outside the security organization with central AI programs, IT or the business unit, and that buyer has no incumbent to renew with. We believe successful products will become the system of record for which AI is approved to do what, wired into the enforcement and evidence layers so that governance becomes the gate to adoption.

Agent & Non-Human Identity

Enterprise IAM assumes a person behind a credential, access approvals measured in months and an approver who is available. None of this survives a population of short-lived agents that authenticate to one another and will likely eventually (if not already) outnumber employees. Half of respondents required agent identity before go-live and only one in eight bought anything new, so that gap is timing rather than absent demand. Legacy platforms including Okta, Microsoft Entra, CyberArk and SailPoint will offer solutions as an extension of their human IAM products which we don’t believe will  be architected in a way that scales to the new world. The problem needs to be solved from the ground up, including how machine credentials get issued, scoped, delegated and retired in seconds rather than months, and startups are best placed to capture the value now ahead of agent populations growing exponentially.

AI SIEM & SOC

The constraint in this category has often been human labor and this becomes unscalable in the age of AI. Alert volumes already overwhelm security analysts, and the triage work in between requires judgment that could never be codified. This is why a decade of SOAR playbooks were never able to absorb it. AI provides the ability to reason over messy, inconsistent evidence. The SIEM underneath has the same problem in a different form, because exorbitant costs force enterprises to choose what to log, so prompts, tool calls and agent decisions are what get trimmed. Once machines (vs. humans) are responsible for sifting through logs, a workflow built around dashboards and saved queries no longer makes sense. That is the rare combination for a founder: rising volumes from AI adoption and AI-accelerated attacks, a budget line that already exists, and incumbents like Splunk, Microsoft Sentinel and Elastic whose economics rest on the volumes that automated investigation compresses.

What we think happens next

Enterprise AI is gated on security, and that is a significant tailwind for every security founder. Buyers have problems they cannot postpone and have no written playbooks. This is the condition under which large new platforms have always been built.

For founders, the encouraging read is that the incumbent advantage is narrowing. Almost nobody is waiting for a platform vendor to catch up. Decision makers will buy the product that is materially better, clears their requirements, and does not duplicate something they already pay for. With AI adoption accelerating, they now have net new budget to do it with. If what you are building is the reason an AI project ships instead of stalling, you are selling into a market that is ready to buy.

If you are building towards the needs of adopting safe, successful AI, we at Greycroft are excited to work with you.

Methodology & sources

Methodology. Greycroft conducted a survey in August 2026 of 50 senior enterprise security leaders, approximately 70% of whom held CISO or CSO-level roles. Participating organizations primarily had 1,000 to 50,000 employees. Individual question sample sizes varied from 39 to 50 respondents. Survey findings reflect the views and experiences of participating respondents and may not be representative of the broader enterprise security market. Full survey results.