ai risk today logo svg bl font
Menu
SUBSCRIBE
SUBSCRIBE
ai risk today logo svg bl font
Menu

Cloud Security

Neon illustration of AI security connected through a complex digital network.

Orca Finds Companies Are Expanding AI Faster Than They Can Secure It

, , , , , , , , , ,

Orca Security examined more than 1,200 companies and found that businesses are adopting new AI tools faster than they are securing the data and systems connected to them.

Key Takeaways

  • 64% of companies using AI have deployed vector databases, which help AI systems search company information.
  • 56% have put AI systems capable of performing tasks with limited human direction into production.
  • 57% of companies using Amazon Bedrock agents have not enabled the platform’s built-in safeguards.
  • 29.5% of companies using AI have at least one exposed AI credential. 
  • More than half of organizations use at least four different categories of AI services.

Orca Security’s 2026 State of AI Security Report found that companies are rapidly expanding their use of AI while struggling to apply the same security controls they use elsewhere in their business. The report collected anonymized data from more than 1,200 organizations during the second quarter of 2026.

The findings suggest that AI is moving beyond experimentation and becoming part of day-to-day operations. Companies are deploying a growing mix of AI-powered assistants, coding tools, and systems that can access internal information, often faster than security teams can keep up with.

AI tools spread

One of the report’s clearest findings is how quickly companies are adopting different types of AI technology. Orca found that 55.3% of organizations using AI now rely on at least four different categories of AI services, while nearly one in five use seven or more.

The report also found that 64% of AI adopters have deployed vector databases. These systems help chatbots and other AI tools search company documents and answer questions, but they also create new connections between AI systems and sensitive business information.

At the same time, 56.2% of organizations have deployed AI systems capable of planning and performing tasks with limited human oversight.

Companies are still learning how to secure AI systems

On Amazon Web Services, organizations using Amazon Bedrock run an average of about 15 AI agents that can interact with company systems and data. Yet 57.1% of those organizations did not enable Bedrock’s built-in safeguards, which are meant to limit what the systems can do and reduce harmful outputs.

Orca also warned that vector databases create new ways for attackers to reach company information because they connect AI tools directly to internal data. According to the report, companies are adopting these systems faster than many security teams can monitor and secure them.

More broadly, organizations are deploying AI tools across multiple departments and cloud platforms, often without a clear picture of what is installed or what information those systems can access.

Basic security practices still lag behind

Many of the report’s findings involve familiar AI security problems rather than entirely new threats.

Orca found that 29.5% of companies using AI had at least one exposed AI credential, such as an API key that could provide access to AI systems or company data. According to the report, these credentials can allow attackers to access a business’s sensitive information or run AI services at the company’s expense.

Green geometric pufferfish illustration representing the JADEPUFFER AI agent behind a near-autonomous AI cyberattack

The First Autonomous AI Cyberattack? Almost.

, , , , , , , , , ,

Researchers say a documented ransomware attack marks the closest example yet of an AI agent attacking on its own after a human provided the initial access.

A documented ransomware attack provided what researchers believe is the closest real-world example yet of an AI agent carrying out much of a cyberattack autonomously. But there was one important catch: a human attacker still selected the victim, obtained valid credentials, and initiated the operation.

Security researchers at Sysdig say the attack demonstrates how AI agents are beginning to automate significant portions of ransomware operations that previously required skilled human operators. While the attack was not fully autonomous, the researchers say it represents an important milestone in the evolution of AI-assisted cybercrime.

The attack involved an AI agent known as JADEPUFFER, which researchers observed performing many of the steps needed to compromise a cloud-hosted database environment. Rather than following a rigid script, JADEPUFFER was able to make decisions, adapt its actions as conditions changed, and continue working toward its objective with limited human involvement.

According to Sysdig, the human operator’s role was to identify the target organization and provide stolen credentials that allowed the AI agent to access the environment. From that point, the AI agent carried out much of the attack, including exploring the environment, locating valuable data, and preparing it for extortion.

Sysdig researchers emphasized that the attack should not be described as fully autonomous. The AI agent did not independently choose its victim or discover an initial way into the network. Instead, it relied on a human to provide those critical starting conditions before taking over much of the operation.

Even so, Sysdig says the incident illustrates how advances in AI agents could reduce the amount of expertise and manual effort traditionally required to carry out ransomware attacks. Instead of doing each step themselves, attackers could let AI handle more of the work and figure things out as it goes. The researchers noted that the attack was not the work of a sophisticated nation-state group or major ransomware organization.

While AI played a significant role in this incident, Sysdig concludes that human involvement remained essential. Therefore, the attack stops short of being the first fully autonomous AI cyberattack, but it demonstrates that attackers are closing in on that reality.