“13% of IT and security professionals confidently claim full visibility into the AI tools active within their organization.”
Visibility into active AI tools: a narrow minority
That single stat, from a report by Drata, captures the central dilemma facing organizations that have rushed to add artificial intelligence into governance, risk, and compliance (GRC) workflows. Drata’s analysis of survey responses from security and IT professionals finds that 87% of respondents admit they are “governing (or attempting to govern) something they cannot fully see.” The report frames that gap in visibility as a foundational risk — a blind spot that makes other controls and assurances harder to rely on.
Audit outcomes and regulatory lapses: measurable consequences
The visibility gap is not merely theoretical. According to the report, 71% of organizations say an AI tool used for GRC has led to a failed audit or a lapsed regulatory standard at least once. That finding ties the abstract problem of unseen tools to concrete compliance failures, indicating that gaps in discovery, configuration, or controls around AI integrations have already manifested in audit outcomes and regulatory exposure.
Buyers, vendors, and governance: three compounding failures
Drata traces the widening shortfall between expectations and delivery to three compounding failures: vendors oversold, buyers bought breadth, and governance never caught up. In other words, the market created demand for broad, feature-rich platforms, vendors marketed expansive capabilities, and organizational governance processes did not evolve quickly enough to vet, monitor, and control the new classes of AI tools that entered environments.
Platform preferences: targeted agentic systems over all‑in‑one stacks
The report finds procurement and risk priorities shifting in response. Overall, 64% of respondents prefer targeted agentic AI systems rather than broad, all‑in‑one platforms. Among risk‑focused buyers that preference strengthens to 70%. Those numbers suggest a material tilt toward more narrowly scoped tools that can be evaluated and bounded more easily than comprehensive suites purported to solve multiple problems at once.
Operational responses: faster discontinuation and manual fallbacks
Organizations are already changing how they respond when AI tools underperform or expose shortcomings. Three‑quarters now discontinue underperforming AI tools faster than they used to, the report says. At the same time, when shortcomings are exposed, more than half of respondents revert to manual processes. That combination — quicker decommissioning paired with manual fallback — signals both a loss of confidence in some AI deployments and a pragmatic retrenchment to time‑tested controls while buyers reassess options.
On the vendor review side, Drata’s survey detects benefits when organizations use an external trust center: nearly half of organizations with an external trust center report greater transparency into vendor security, and 44% report faster vendor reviews. Those results point to a concrete institutional tool that some buyers say improves visibility and speeds decision timelines.
What this means for technologists, procurement leaders, and compliance teams
- Technologists and security teams: Expect to prioritize discovery and inventory work. With only 13% reporting full visibility, these teams will likely focus on tools and processes that surface active AI integrations and provide continuous monitoring.
- Procurement leaders and risk-focused buyers: The preference for targeted agentic systems (64%, 70% among risk buyers) suggests procurement will increasingly favor narrowly scoped offers that are easier to test and retire, rather than sweeping all‑in‑one claims.
- Compliance teams and auditors: A 71% rate of audits or standards lapsing due to AI tools means compliance owners will be watching vendor assurances and third‑party controls more closely, and may demand external trust‑center evidence given the reported transparency and speed benefits.
Drata’s survey paints a market in mid‑correction: high expectations met by uneven implementations, rapid off‑ramps when tools disappoint, and growing appetite for narrower, more controllable AI capabilities. The arithmetic is stark — most organizations are governing technology they cannot fully see, and a majority report that GRC‑focused AI tools are not enterprise ready (86%) and that they are not fully prepared for the coming wave of AI integration (83%). Whether organizations will close the visibility gap by adopting targeted agents, bolstering governance, or relying on external trust mechanisms is the practical question the report leaves in sharp relief.
Original story: https://www.securitymagazine.com/articles/102434-majority-of-organizations-agree-that-many-grc-ai-tools-arent-ready
