With development moving at breakneck speed, many enterprise leaders are scrambling to understand AI security risks and protect their organizations from emergent threats.

In fact, the “unknown unknowns” of the current era are driving a level of industry tension rarely seen before, according to Jon Oltsik (pictured, left), principal analyst at theCUBE Research. Many organizations are still in the early stages of preparedness, even as adoption outpaces the policies and controls needed to manage it. The risk is no longer just about external bad actors, but how internal organizations are already deploying these technologies without adequate guardrails, Oltsik added.

“AI development is happening very, very quickly,” Oltsik said, reflecting on early conversations at the RSAC 2026 Conference. “There are a lot of elements to AI development that we’re just learning about … and we really don’t understand the security implications and how to defend ourselves yet. Every meeting I had, there was that theme of ‘this is coming’ or ‘it’s here and this is what we think we should do, but we’re not sure yet.’ We’re a little bit spitballing right now, but it’s important that you spitball and you do things in the right way because it’s coming and it [isn’t] stopping.”

Oltsik and Dave Vellante (right), co-founder and chief analyst of theCUBE Research, unpacked the key themes of day one of the RSAC 2026 Conference, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed the growing threat landscape, the pace of enterprise adoption and the urgent need for stronger governance. (* Disclosure below.)

Establishing resilience against AI security risks

From infrastructure providers such as Dell Technologies Inc., to major enterprise adopters including Capital One Software, a division of Capital One Financial Corp., companies are racing to get ahead of AI security risks while also securing their own use of the technology. But keeping pace with the speed of innovation requires organizations to begin with sound, enterprise-wide policies. That kind of framework is essential to reduce activity happening without oversight, Oltsik explained.

“It starts with strong governance, and that governance has to be enterprise-wide,” he said. “The CISO doesn’t own governance, but he or she contributes to it. But the business has to buy in and from governance, you build policies and from policies you build controls. If you start in that context, then at least you have a framework for control.”

That framework for control is becoming increasingly important as security leaders confront a threat environment defined by speed, uncertainty and constant change. But governance alone is not enough. To keep pace, organizations must be able to move quickly and at scale — and that means not only adopting the right technologies, but embedding security thinking across the business, Vellante noted.

“I always say bad human behavior beats good security and governance every time,” Vellante said. “It’s got to be cultural. It’s got to be ingrained.”

Here’s the complete day one analysis, part of SiliconANGLE’s and theCUBE’s coverage of the RSAC 2026 Conference:

(* Disclosure: TheCUBE is a paid media partner for the RSAC 2026 Conference. Neither RSAC, the primary sponsor of theCUBE’s event coverage, nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE