19 March 2026
,-
Your organisation has deployed AI. Your colleagues are enthusiastic. Your board wants an update. And somewhere in your infrastructure, AI agents are autonomously querying your CRM, triggering workflows, and modifying database records using API keys that nobody is monitoring.
This briefing focuses on three converging developments that should be on every CISO's radar: the collapse of AI visibility in enterprise environments, the Model Context Protocol becoming a serious attack surface, and a White House cyber strategy that is long on ambition and short on resources.
,-
67% of CISOs Cannot See Their Own AI
Pentera's AI and Adversarial Testing Benchmark Report 2026, based on surveys of 300 US CISOs and senior security leaders, delivered a number that should stop any board conversation in its tracks: 67% of CISOs report limited visibility into how AI is being used across their organisation. None of the respondents claimed full visibility. Not one.
This is not a funding problem. Only 17% cited budget as a primary barrier. The top obstacles are lack of internal expertise (50%), limited visibility into AI usage (48%), and insufficient tools designed specifically for AI systems (36%).
The gap is structural. AI systems are rarely deployed in isolation. They sit across cloud platforms, identity systems, applications, and data pipelines, with ownership fragmented across teams that have no shared reporting line to security. The result is that basic questions , which identities do AI systems rely on, what data can they reach, how do they behave when controls fail , remain unanswered.
75% of CISOs are extending legacy security controls to cover AI infrastructure. Endpoint security, API gateways, and application security tools were not built for systems that make autonomous decisions and chain API calls across multiple environments. Applying them to agentic AI is the equivalent of using a perimeter firewall to secure a zero-trust network. The mental model is wrong, and the controls will reflect that.
What this means for you: The first step is not a new tool purchase. It is a discovery exercise. Where are AI systems operating in your environment? What identities are they using? What can those identities access? Most organisations cannot answer these questions yet.
,-
The Non-Human Identity Problem Just Got Worse
Delinea published research in March based on a global survey of over 2,000 IT decision-makers. The headline finding is alarming in a very specific way: 90% of organisations are under pressure from business leadership to loosen identity controls to enable AI initiatives.
Security teams are being asked to compromise their controls to accelerate AI adoption. And many are complying.
The data behind this matters. AI agents now routinely have write access to collaboration tools (53%), email (40%), code repositories (25%), and in 8% of cases, identity providers themselves. 91% of organisations only discover what an agent did after the action has already executed. 80% cannot always explain why a non-human identity performed a privileged action.
Machine identities now outnumber human employees 82 to 1 in the average enterprise, according to Palo Alto Networks' 2026 Cyber Predictions report. The Huntress 2026 data breach report identified non-human identity compromise as the fastest-growing attack vector in enterprise infrastructure.
Standing privileged access is the norm. 59% of organisations report lacking viable alternatives to persistent privileged access for AI agents, which means these identities retain access indefinitely rather than being issued just-in-time credentials for specific tasks.
This is not a theoretical risk. It is the architecture of a breach that has not happened yet at your organisation, but is happening somewhere right now.
What this means for you: AI agents need the same governance as privileged human accounts , least-privilege access, just-in-time provisioning, full audit trails, and regular access reviews. If your PAM solution cannot handle non-human identities, that conversation with your vendor needs to happen this quarter.
,-
MCP Is the Backdoor Zero Trust Forgot
If your organisation is deploying AI agents , and 83% of businesses plan to, per Cisco's State of AI Security 2026 report , those agents are likely using the Model Context Protocol. MCP is the standard that connects AI agents to external tools, data sources, and APIs. It has become the default plumbing of the agentic AI ecosystem in roughly eighteen months.
The security posture of that ecosystem is not good.
Between January and February 2026, security researchers filed over 30 CVEs targeting MCP servers, clients, and infrastructure. One vulnerability, CVE-2026-27896 in the official MCP Go SDK, scored CVSS 9.6 , remote code execution in a package downloaded nearly half a million times. A scan of internet-exposed MCP infrastructure found approximately 7,000 exposed servers, roughly half of all known deployments, many operating with no authorisation controls whatsoever.
SC Media ran a piece in March describing MCP as "the backdoor your zero-trust architecture forgot to close." That is not hyperbole. Researchers have documented cases where compromised MCP servers allowed attackers to exfiltrate data from private repositories by manipulating the agent's context at the protocol layer. The OWASP Top 10 for Agentic Applications lists tool call hijacking and orchestrator manipulation as top-tier risks. BlueRock Security found that 36.7% of MCP servers they scanned contain exploitable vulnerabilities.
OWASP has now published a dedicated MCP Top 10, covering tool poisoning, rug pulls (where a trusted server updates its tool definitions maliciously), code injection, credential leakage, excessive permissions, and insufficient isolation. Each of these is exploitable now in production environments.
The deeper problem is that traditional SAST tools cannot identify issues in LLM-to-tool flows, conversation state management, or agent-specific trust boundaries. You cannot simply run your existing code scanning pipeline over MCP infrastructure and get meaningful results.
What this means for you: If you have AI agents in production or in development, audit every MCP server connection now. Treat each MCP server as a third-party integration that requires the same security review as any external API. If your development teams are spinning up MCP servers without security review, that is a process gap that needs closing immediately.
,-
Trump's Cyber Strategy: Big Words, Small Budget
The White House released its cybersecurity strategy on 6 March. At four pages, it is more a declaration of posture than a strategic plan. The tone is assertive , a statement that the United States will respond to cyberattacks offensively and proactively, that adversaries have been warned, and that American cyber capabilities are unmatched.
CSIS described it as "a statement of goals rather than a strategy" and noted it is "remarkable for what it lacks: a conversation about matching resources to these goals."
Politico was less diplomatic, quoting one analyst who noted the strategy is "completely lacking the most basic blueprint for how the administration will go about achieving any of its cybersecurity goals," a challenge made harder by the haemorrhage of cyber talent across federal agencies since the start of the administration.
For enterprise CISOs, the practical implication is this: the US government is signalling a more aggressive offensive posture against adversaries, which may influence adversary behaviour, but the regulatory and governance environment remains uncertain. CISA still lacks a Senate-confirmed director. The administration is delaying the final cybersecurity incident reporting rule until May 2026 at the earliest. The Forrester analysis notes that with CISA downsized and reorganised, individual agencies will struggle to meet the broad objectives in the strategy.
For multinational organisations, a more fragmented US cyber governance landscape means less clarity on reporting obligations, less federal coordination on threat intelligence sharing, and potentially wider variation in how different agencies interpret security requirements.
What this means for you: Do not wait for regulatory certainty before making decisions. The threat environment is not pausing for policy. Build your security programme around current threats and your own risk appetite, not the expectation of imminent guidance from Washington.
,-
The Signal
Every story here connects to the same underlying problem. AI systems are being deployed faster than security teams can govern them. The identities those systems use are invisible, over-privileged, and increasingly targeted. The protocols connecting them to enterprise data are riddled with vulnerabilities that existing tools cannot catch. And the policy environment is providing less structure, not more.
The CISO job in 2026 is not fundamentally different from what it was in 2006: understand what is in your environment, understand what it can access, and ensure those who can cause harm cannot reach what matters. The hard part is that "what is in your environment" now includes systems that create other systems, use identities that no human provisioned, and operate at machine speed.
You cannot monitor what you cannot see. That is where the work starts.
,-
Jonathan Care has 33 years in cybersecurity and fraud detection. He is Lead Analyst at KuppingerCole and writes about security strategy for senior security leaders. These are his personal views.
Sources: Pentera AI and Adversarial Testing Benchmark Report 2026; Delinea "Uncovering the Hidden Risks of the AI Race" (March 2026); Spiceworks / Cisco State of AI Security 2026; SC Media MCP analysis; OWASP Top 10 for Agentic Applications 2026; VentureBeat / Nvidia GTC 2026 coverage; CSIS analysis of White House Cyber Strategy; Politico; Forrester.