Delinea Report Finds 87% of Organizations Saw an AI Tool Access Sensitive Data Beyond Its Scope in the Past Year
New research reveals a gap between AI policy and enforcement, and pressure on employees to use AI on sensitive data
Press Release Disclaimer: This is a press release distributed through the XPR Media network. It has not been independently verified by our newsroom.
SAN FRANCISCO, Sept. 29, 2026 (GLOBE NEWSWIRE) — Delinea, the identity security platform that continuously controls what AI agents, humans and machines can do and for how long, today published new research examining where AI governance breaks down in practice. According to the report, 2026 Identity Security Report: The AI Enforcement Gap, 87% of IT leaders say an AI tool or agent accessed sensitive data beyond its intended scope in the past year. The report also found that fewer than one in five can detect a scope violation as it happens.
The findings draw on two global surveys of 2,254 IT and security leaders and 2,250 non-IT employees at organizations of 500 or more employees that use AI, across the UK, US, Germany, Australia, Singapore, UAE, France and India. Together, they show that near-universal policy adoption has done little to change how employees handle AI in practice. Employees are already routing around it: 76% say they have bypassed the required approval process for using AI at some point.
“Written policy is only as good as your ability to enforce it at the moment an AI agent acts,” said Art Gilliland, CEO of Delinea. “Our research echoes what I hear from leaders constantly: they have the AI policies in place, but they can’t see or report on what their agents actually do.”
Key findings from the report include:
- Policy adoption has outpaced enforcement: 99.7% of organizations now have a formal policy governing what data AI tools and agents can access, yet only about half check that access against policy in real time.
- Employees feel pushed past the guardrails: 60% say they have felt pressured to use AI on sensitive or confidential data even when they were unsure it was permitted. When deadlines outpace the governance process, many look for a faster route instead of following it.
- Accountability is thin: just 36% of IT leaders can always trace a sensitive AI access event back to a named human authorizer, even though nearly all organizations require named-individual approval for at least some sensitive use. The gap lies in execution rather than in the rules.
The gap is widest where developers offload the most work to coding agents
Across six major environments, 47% of organizations lack enforcement at the moment of action in at least two. The weakest are CI/CD pipelines and Kubernetes, and even the strongest, cloud data stores, leaves gaps. When an agent steps outside its scope, detection lags: 55% of organizations take a full day or longer to catch it.
Closing the gap between policy and enforcement calls for authorizing AI access at the moment of action, not only at login. Delinea applies continuous, runtime authorization with least-privilege scoping and full session visibility across AI, human and machine identities, giving security teams a defensible record of who authorized each access, what the agent did and why it was allowed.
To read the full findings, download the report here: https://delinea.com/resources/ai-policy-enforcement-report
About Delinea
Delinea is an identity security platform governing what AI agents, humans and machines can do, and for how long. Just-in-time authorization extends privileged access management from access to action, cutting standing privilege across on-premise, multi-cloud and ephemeral infrastructure. Its platform scores identity risk and keeps access decisions auditable. Over 9,000 organizations, including two-thirds of the Fortune 100, rely on Delinea. Learn more at delinea.com.
Media Contact Justin Ordman Corporate Communications Director PR@delinea.com
