Shift towards Hybrid AI places governance at top of CISOs’ agenda

Gigamon’s report, published under the heading ‘CISO Empowerment in the Age of AI Risk’, is based on global responses from more than 300 CISOs and reveals growing AI-related security incidents, visibility challenges and governance concerns as AI adoption accelerates.

The findings emerge as AI begins to follow a path similar to cloud. Rather than standardising on a single model, organisations are increasingly combining frontier, open weight, specialised and privately hosted AI models in order to balance performance, security, governance, sovereignty and cost.

This emerging Hybrid AI architecture offers greater choice and flexibility, but also creates new connections among models, applications, infrastructure and organisational data that security teams must be able to understand and govern.

Growing governance gap

“Hybrid AI is moving faster than governance,” explained Grant Yacomeni, CISO at Gigamon. “Organisations want the flexibility to choose the right AI for every workload, but that flexibility depends on having the visibility to govern it. CISOs need to understand which AI systems are in use, how they interact with applications and data and what’s happening across those connections. You cannot govern what you cannot see.”

The report shows that governance is struggling to keep pace with AI adoption. Among those organisations experiencing a breach over the past year, 83% report AI-related security incidents, with 30% reporting internal leaks into AI systems and the same percentage unsanctioned AI use.

For CISOs, that governance challenge increasingly extends into the Boardroom, where a lack of understanding of security Best Practice is a concern for seven in every ten CISOs (who say it could cause AI adoption to outpace security readiness). Closing that gap is becoming a priority, with 41% ranking improved Board understanding of AI risks and benefits among their top security priorities for the next 12 months.

The stakes are also becoming more personal. More than one in every four CISOs are concerned about losing their job following a serious cyber incident, duly reflecting the growing accountability security leaders face as they balance the risk of AI innovation with security and risk in general.

Visibility equation

The research results also point towards a fundamental shift in terms of how CISOs are thinking about security investment. Limited visibility into AI-driven traffic is a major barrier to securing AI adoption for 76% of CISOs, while 45% are prioritising improved visibility into AI-driven data flows across hybrid cloud infrastructure.

Despite these concerns, organisations continue to invest heavily in security technology. Nearly nine in every ten CISOs (88%) report deploying new tools to improve detection and visibility, yet breaches continued to rise, increasing by 18% year over year and underscoring the fact that additional tools alone are not delivering the context CISOs need across increasingly complex environments.

The research reveals visibility gaps across several critical areas:

Incident response

When responding to an incident, only 27% of CISOs say their organisation can identify root cause and restore normal operations within 72 hours, compared with 48% of other C-level executives, duly highlighting a significant gap between operational reality and executive perceptions of security readiness. 

East-West traffic 

Lateral East-West traffic is identified by 36% of CISOs as an area of greatest breach risk: an increasingly important concern as AI models, applications, agents, data and infrastructure communicate across distributed environments.

Encrypted traffic

Visibility into encrypted traffic was identified by 86% of CISOs as critical for post-quantum computing readiness, while 89% suggest that improved visibility into encrypted traffic could assist in reducing cyber insurance premiums.

Role of deep observability

As today’s organisations transition towards Hybrid AI, CISOs have identified critical capabilities, including access to accurate network-derived telemetry and comprehensive visibility into data in motion.

Network-derived telemetry – including packets, flows and application-aware metadata – adds context to metrics, events, logs and traces (MELT) data, enabling deep observability that helps security teams to understand how AI systems, applications and data interact across hybrid cloud infrastructure. The need is clear, with 87% of CISOs reporting that deep observability is foundational when it comes to securing their AI deployments.

This fourth iteration of the annual Gigamon study surveyed more than 1,000 security and IT leaders (including 307 CISOs) across the UK, the US, Australia, France, Germany and Singapore.

*Read the ‘CISO Insights: CISO Empowerment in the Age of AI’ report in full 

**Download the report ‘2026 Hybrid Cloud Security Report: Reality Check: Exposing the AI Security Illusion’ based on data from more than 1,000 security and IT leaders 

***Access the ‘Financial Services Industry Insights: The Visibility Imperative in the Age of AI’ report based on data supplied by 139 security and IT leaders operating in the financial services sector