Red Hat Survey Finds AI Security Confidence Outpaces Visibility in UK Enterprises

Red Hat, the world's leading provider of open source solutions, has announced the results of a survey examining enterprise artificial intelligence (AI) adoption and risk management across 1,400 CIOs across 14 countries, including the UK. The research indicates that while autonomous AI agents are rapidly moving into enterprise production, with all UK businesses surveyed already deploying agents in production, a critical gap persists between perceived governance and actual operational visibility.

The majority of UK CIOs surveyed (97%) report high confidence that their AI agents operate securely and in compliance with regulations, supported by guardrails and monitoring. However, the data highlights that this optimism can mask a lack of visibility:

• 43% of respondents report having a precise understanding of data flows within their organisation and the knowledge of where data is stored and processed.
• Only 31% have a comprehensive overview of their software supply chain as well as direct and indirect dependencies.
• 36% assess the risk posed by AI providers before adoption, but have limited ongoing monitoring afterwards

These results indicate that while survey respondents feel that their AI agents and environments have appropriate security and sovereignty controls, the reality shows a lack of auditable proof in these operations. The dynamic nature of AI innovation and market forces make it possible for a system to have high levels of security and compliance at deployment, but then be completely exposed soon after.

Small gaps in visibility, major risk to data

UK enterprises are accelerating their AI adoption curve, with 41% of respondents stating they can fully rely on tested guardrails, continuous monitoring and automated intervention mechanisms. A further 56% of UK companies are 'fairly confident' that they have security and compliance under control, but acknowledge minor gaps in their guardrails and monitoring. In production environments unmonitored data exchanges between enterprise platforms, cloud services and external AI models can create risks. Comparatively, visibility varies widely across borders: while 61% of respondents in South Africa claim end-to-end data flow visibility, French organisations trail at 31%. For UK enterprises navigating stringent regulatory environments like GDPR and the EU AI Act, establishing verifiable, lifecycle-wide data traceability remains essential to avoid non-compliance and data leaks.

The great risk of indirect software dependencies

As many as 83% of UK companies surveyed report that they are able to patch critical software vulnerabilities within 24 hours once a fix becomes available. The remaining companies take a few days, with none indicating that it takes longer than a week. The average deployment time is 19.81 hours for UK organisations.

However, most companies do not know exactly which software components are in use. Only 31% have a complete and constantly updated overview of all the open source components they use, including their origin, version numbers and direct and indirect dependencies. Across all the countries, the average figure is just under 33%.

Whilst 56% of in-region companies have a good overview of the components and versions, they note concessions when it comes to understanding origins and indirect dependencies. 11% of respondents lack a complete overview, partly because they focus on components from large projects or because visibility depends heavily on the specific applications or business units using them.

Indirect dependencies are common in many open source software projects, meaning that they incorporate libraries, frameworks and other components from other projects. These dependencies can often pose significant risks for an organisation's IT estate, especially if they are not effectively evaluated (69%2).

Risk assessments as an ongoing rather than a one-off task

When it comes to assessing risks posed by AI providers, 38% of UK companies report that they are well-prepared and have measurable, continuously monitored criteria as part of their day-to-day AI operations. This is significantly more than in the Netherlands, for example (just under 22%), but considerably less than in Italy (51%).

Although 36% of companies surveyed in the UK conduct a risk assessment before implementing new AI technologies, they struggle to monitor and evaluate those risks afterward. Twenty-two percent rely solely on an initial evaluation, which can be insufficient in the rapidly evolving world of AI, as models, data, regulatory requirements and threats change almost daily.

This challenge and the need to address it through measurably, internally-controlled methods is not lost on survey respondents. Only 2% of UK companies rely solely on external audits, certifications and contractual assurances for their risk assessments. And just 1% rely on the reputation of providers and past experience or have no structured approach to assessing provider risks.

Quotes

Joanna Hodgson, UK country manager, Red Hat.

"Most companies are relatively confident they can manage AI security, that they can effectively monitor and control AI agents. However, our research shows that the lack of comprehensive and continuous transparency regarding data flows, software dependencies and vendor risks means they may not be realising the full value that AI presents. Open architectures with centralised management can help companies maintain control and remain flexible when selecting models and providers."

Chris Jenkins, senior principal chief architect, global CTO Organisation, Red Hat

"Reporting that a critical flaw can be patched within 24 hours sounds encouraging, but teams also need to know where the affected software is running and what data it can access - something that takes enterprises on average 45 days. One vulnerable component can sit within several applications across multiple environments, making identification of those connections crucial when deciding which fixes need urgent attention. As AI agents gain access to more business systems, understanding those connections becomes even more important and the need for good cyber hygiene all the more essential. Businesses need an accurate software inventory to prioritise fixes, alongside controls that restrict access and contain a compromise."

Methodology: The survey was conducted by Censuswide among 1,400 CIOs (25+) across the UK, France, Italy, Germany, Spain, the UAE, Sweden, Turkey, Switzerland, Poland, South Africa, the Netherlands, Belgium, and Saudi Arabia between August 24, 2026, and September 1, 2026. Censuswide is a member of the Market Research Society and the British Polling Council, and a signatory to the Global Data Quality Pledge.