AI in companies no longer runs on just one layer. It's active at the same time among employees, developers, in a company's own models, and with autonomous agents. If you only secure one of these four layers, you leave the other three exposed, as the current AI Risk and Readiness Report shows.
The governance paradox
The underlying problem is well known: 73 percent of companies already use AI tools in production, but only 7 percent have real-time governance that actually enforces policy technically. 90 percent have increased their AI security budgets, yet 29 percent feel less secure than twelve months ago. The paradox isn't explained by a lack of willingness to invest, but by a structural misdiagnosis. Most security strategies treat AI risk as a single problem. In reality, it's five, each with its own actors, data flows, and attack surfaces.
Employees, developers, and in-house models
The most visible AI activity is everyday use by employees, for things like summaries, research, or code suggestions. The real challenge, though, sits one level deeper: 47 percent of employees use AI tools through private accounts not controlled by the company, and 88 percent of security teams can't reliably distinguish between an authorized company tenant and a private account on the same platform. That leaves classic access controls toothless, not because they're missing, but because the foundation they need to act on isn't there.
A different risk emerges when developers embed LLM APIs directly into production applications. Here there's no human input in the classic sense, just applications that automatically send requests to external language models and feed the responses into business processes. Classic security tools, built for human interactions, simply don't see this layer at all.
More and more companies are also running their own internally hosted models, trained on proprietary data and embedded in critical processes. That reduces dependence on external providers but shifts the security problem entirely onto the company itself. Two moments matter here: before deployment, when red-teaming tests the model's behavior under adversarial conditions, and afterward, when it comes to how the model responds to prompt injection in production.
Autonomous agents and missing visibility
The fastest-growing use case, and the one least covered by existing security architectures, is autonomous AI agents that access company systems via the Model Context Protocol (MCP) and act on behalf of authorized users. A growing majority of organizations already face concrete agent-related risk, a significant portion of it through shadow deployments the IT department knows nothing about. In many organizations, AI agents already have direct write access to collaboration platforms, email systems, and in some cases even identity providers, the systems that control every other kind of access. The problem is structural: an agent authenticates as an authorized user, makes non-deterministic decisions, and can be manipulated through prompt injection, all without any single transaction looking suspicious.
All four layers depend on a foundation that's missing at most companies: a complete, up-to-date overview of which AI systems are actually in use. Only 6 percent of organizations report full visibility into all AI activity in their environment, meaning 94 percent make security decisions based on an incomplete picture.
Conclusion: one platform instead of many isolated tools
The complexity of these five layers shows that point solutions run into their limits. A fragmented approach leads to security gaps and administrative overload. It makes more sense to rely on platforms that provide end-to-end visibility and control, from user interaction at the endpoint all the way to autonomous agent activity in the data center. A real AI security strategy doesn't start with the question of how to block risks, it starts with the question of what's actually running in your environment.