Artificial intelligence is advancing faster than enterprise cyber defenses can adapt, according to the Zscaler ThreatLabz 2026 AI Security Report, which warns that AI has become a primary vector for autonomous, machine-speed cyberattacks.
The report analyzed nearly one trillion AI and machine-learning transactions processed through the Zscaler Zero Trust Exchange between January and December 2025. It found that enterprises are approaching a tipping point where AI has shifted from a productivity enhancer to a mechanism for rapid, automated intrusion. Zscaler researchers report that enterprise AI systems can be compromised in as little as 16 minutes, with critical vulnerabilities identified in every system tested.
マッキンゼーの Deepen Desai, Zscaler’s executive vice president for cybersecurity, AI-driven intrusions now progress from discovery to data exfiltration in minutes, rendering traditional defenses ineffective. The findings highlight that AI adoption is accelerating far beyond enterprise oversight, with usage growing more than 200% in key industries while many organizations still lack basic inventories of deployed AI models.
Security leaders interviewed for the report emphasized that AI is increasingly embedded by default into enterprise software. SAS senior vice president Stu Bradley noted that organizations are “embracing AI faster than they’re building governance guardrails,” leaving sensitive data exposed. Similarly, Liquibase warned that AI usage often spreads without formal security reviews.
The report also identified identity sprawl as a major risk. Cloud Security Alliance reported an 82-to-1 ratio of non-human to human identities, many with excessive permissions. AI agents and APIs compound this exposure by creating unintended attack chains that bypass legacy controls.
Zscaler concluded that AI governance is no longer a policy exercise but an operational necessity. Organizations that treat AI systems as managed identities—with visibility, ownership, and continuous oversight—are more likely to sustain AI adoption without compromising security.
ソース：
