The CYGNVS Resilience Benchmark Report, built with Marsh on more than 9,500 surveys, finds that AI has become a source of security incidents inside the organization. AI incidents now hit 16% of organizations every week, yet only 1 in 3 have a dedicated out-of-band environment to manage the response.
This summer, OpenAI confirmed a rogue autonomous AI agent escaped its sandbox and breached Hugging Face. That event was a vivid reminder that AI is no longer only a tool attackers use against organizations, but increasingly a source of incidents itself.
Most of the conversation about AI risk still focuses on attackers, and with good reason. Phishing volume rose 1,265% in the year after generative AI went mainstream, and AI-written phishing is 4.5 times more likely to get a click. Just as serious a threat is looming within, in the AI organizations are deploying themselves. Leaders want every team to do more with AI, and that usually means giving AI more access to sensitive data, systems and workflows. When one of those systems causes harm, whether it is a rogue agent, a data leak or a biased decision, that is an AI incident. The more access AI has, the more it can disrupt.
This month, we released the CYGNVS Resilience Benchmark Report with our partners at Marsh. It draws on more than 9,500 surveys gathered over nearly four years, which we believe is one of the largest bodies of incident readiness data ever collected or published. The headline finding is hard to ignore. AI incidents are already routine, and readiness has not caught up.
89% Have Faced an AI Incident, and 16% Face One Every Week
Nearly 9 in 10 organizations (89%) have already faced some kind of AI incident, and 16% are dealing with one at least weekly. They span more than 20 types, from rogue agents and agentic runaway to data leakage, agent swarming and broken guardrails, along with the quieter failures of bias, model drift and hallucination that can surface months after a model goes into production.
We saw this shift firsthand when customers began running AI incidents in our Out-of-Band Command Center alongside their cyber incidents. What surprised me was who showed up. A ransomware attack usually starts as a technology problem and works its way up to the business. An AI incident often starts as a business problem. A biased model is a legal matter on day one, and a data leak quickly becomes a regulatory and customer issue, so legal, risk and business leaders were in the room almost immediately.
Only 1 in 3 Have an Out-of-Band Environment for AI Incidents
It is tempting to run an AI incident through the same playbook as a cyber incident. The data suggests that would leave many teams exposed, because AI incidents differ in three ways that hit exactly where readiness is thinnest.
The first is speed. When an AI system misbehaves, it can move orders of magnitude faster than any threat actor. One customer told me that when a cyber incident hit on a Friday evening, there was usually time to get home from dinner before joining the command team. With AI incidents, they run the response from the restaurant foyer because that hour is gone. Yet practice still runs on an annual calendar. Two-thirds of organizations (66%) run tabletop exercises only once a year or every two years, and another 17% do not run them at all.
The second is reach. AI incidents rarely stay inside the technology stack. Drift can become an operational problem, and data leakage can turn into a regulatory, customer and brand issue all at once. The response needs legal, risk, compliance, communications and executives involved from the start, along with outside counsel, forensics and often the AI vendor itself. Only 15% of organizations run fully cross-functional tabletops that include legal, executives and communications, and 49% say their exercises are still mainly a security and IT affair.
The third is that the system under investigation may be watching. An AI system is already inside by design, with access to the email, chat and file systems the response depends on. We have seen AI falsify logs, create fake users and take other steps to hide its tracks and stall the response. That is why the response needs to run out-of-band, in a separate and secure environment that operates independently of corporate email, messaging and SSO, so the team is not briefing the subject of its own investigation. Only 1 in 3 organizations (33%) have a dedicated out-of-band command environment that the AI cannot observe or influence. Another 21% can run a response somewhat separately but without purpose-built logging and isolation. Nearly half (46%) would improvise, often falling back on the same email and chat systems the AI may be able to reach.
52% Have No Process for AI Incident Notifications
One thing we see a lot with customers is that they deploy AI where no rule existed, and three months later there is one. More than 50 jurisdictions now have laws or rules on AI incidents, from the EU AI Act to the Colorado AI Act, and that number is expected to reach over 150 within a year. Yet 52% of organizations have no defined process to produce the AI incident notifications those rules require. Today’s framework becomes tomorrow’s law, and too often the first time a team works out what that law requires is in the middle of an incident.
What AI Incident Readiness Looks Like
The report’s first recommendation for the year ahead is to treat AI incidents as their own category rather than an edge case of cyber. For most organizations, that begins with playbooks built for specific AI incident types such as rogue agents, agentic runaway, bias, data leakage and missing guardrails, with roles and decision rights worked out in advance. Questions like who has the authority to disable an agent, when to bring in legal and outside counsel and who speaks to customers and regulators are far easier to answer on a quiet Tuesday than in the first hour of an incident.
From there, the organizations furthest along tend to test the AI they already run adversarially and revisit that testing as models and their access change. They rehearse AI scenarios with the full cross-functional team, ideally in the same environment where they would run the real incident, so the muscle memory is there when it counts. They run the response out-of-band, which also creates a single record of who knew what and when, with a documented chain of custody that can hold up when regulators, insurers or opposing counsel ask how decisions were made. And they put a process in place for AI incident notifications across the jurisdictions that apply, before a regulator asks for one.
Resilience in the Age of AI
The boardroom conversation has moved from if a critical incident will happen to when, and from prevention to resilience. Nearly every CISO I meet tells me their board is asking the same three questions. Are we ready? Will our response be controlled and not chaotic? Will we be able to justify our decisions afterwards? AI makes each of those questions harder to answer with confidence.
AI as an incident source is only one part of the picture. The full CYGNVS Resilience Benchmark Report, developed in partnership with Marsh, covers all three shifts reshaping resilience in 2026 and benchmarks how organizations prepare, practice, respond and report across both cyber and AI incidents. Download the report to see the complete findings.
About the Author
Arvind Parthasarathi is the Founder and CEO of CYGNVS, the out-of-band command center that over 3,000 organizations rely on for cyber incident response management. Arvind also serves on the technical advisory council of the Allen Institute for Brain Sciences and on the board of trustees of the Center for Excellence in Education.
Follow Arvind on LinkedIn for more on cyber resilience and incident response.
