Six domains. Eight industries. Five maturity levels. The baseline every enterprise AI security programme needs — built on MITRE ATLAS, OWASP GenAI, and NIST AI RMF.
Artificial intelligence has moved from experimental infrastructure to business-critical infrastructure in less than three years. Organisations are deploying enterprise copilots, RAG systems, AI coding assistants, autonomous agents, and agentic workflows at a pace that their security programmes have not kept up with.
The threat landscape has evolved equally fast. Prompt injection, agent abuse, retrieval poisoning, excessive agency, model theft, and AI supply-chain attacks are now recognised as major enterprise risks by OWASP, MITRE, NIST, and the Cloud Security Alliance. The OWASP GenAI Security Project — now a flagship OWASP initiative — continues to expand its documentation of critical risks affecting LLMs, GenAI systems, and emerging agentic AI platforms.
"Most enterprises are defending the AI they had in 2023. They are deploying the AI of 2026. The gap between those two realities is where the most significant security risk now lives."
AIZA-HexTyx Research, 2026This inaugural AIZA-HexTyx benchmark establishes a structured coverage baseline across six threat domains and eight industry sectors. It draws on six authoritative sources — MITRE ATLAS, OWASP GenAI, OWASP Top 10 for LLM Applications, NIST AI RMF, enterprise incident disclosures, and public AI security research — to produce coverage estimates that practitioners, CISOs, and boards can use as a reference point for their own programmes.
The methodology is transparent and reproducible. Coverage scores are structured analyst estimates derived from framework analysis, not survey data — a baseline that becomes more precise as proprietary tool data accumulates through the AIZA-HexTyx free assessment platform in the quarters ahead.
Key finding: The two lowest-coverage domains — AI agent security (41/100) and AI supply chain security (39/100) — are also the two fastest-growing adoption categories. Organisations are deploying autonomous agents and third-party AI components faster than they are securing them.
The AIZA-HexTyx Coverage Benchmark uses a six-domain threat model derived from the intersection of four major AI security frameworks. Coverage scores represent the proportion of domain-relevant MITRE ATLAS techniques and OWASP controls that a typical organisation at each industry tier is assessed to have addressed, based on publicly available framework documentation, enterprise deployment patterns, and disclosed security incidents.
This v1.0 report is a structured analyst baseline — not a survey. Coverage scores are derived from cross-referencing framework requirements against typical enterprise deployment patterns documented in public research. This is the same approach used by leading analyst firms when proprietary data is not yet available.
The Q4 2026 edition will incorporate real usage data from the AIZA-HexTyx free tool platform: the MITRE ATLAS Coverage Calculator™, MITRE Security Mapping Tool™, MITRE Coverage Benchmark™, and Agent Security Assessments. That data will transform this from an analyst baseline into a proprietary benchmark with statistically grounded scores.
The HexTyx Coverage Model organises the AI threat landscape into six primary domains. Each domain maps to specific MITRE ATLAS tactics and OWASP categories. The enterprise readiness score represents our assessment of the proportion of relevant controls that a typical enterprise currently has in place — not the maximum possible coverage, but where most organisations actually are in 2026.
The foundational LLM vulnerability. AI models cannot inherently distinguish trusted instructions from adversarial inputs — making prompt injection the entry point for a majority of AI attack chains. Direct injection targets chatbots and copilots directly; indirect injection embeds malicious instructions in retrieved content, emails, and documents that AI systems process autonomously.
Why coverage is higher than other domains: Prompt injection is the most documented AI risk and has the most mature tooling. Most enterprises have deployed some combination of input filtering, system prompt hardening, and output validation — though sophisticated attacks regularly bypass these controls.
Key OWASP mapping: LLM01:2025 Prompt Injection, LLM02:2025 Sensitive Information Disclosure.
The fastest-growing AI security gap. Autonomous AI agents can access systems, call APIs, execute workflows, store memory, and take actions that have real business consequences. The OWASP Agentic Security Initiative identifies goal hijacking, tool misuse, and cascading failures as primary concern areas. Unlike prompt injection — where the impact is a response — agent abuse enables actions.
Why coverage is the lowest of all domains: Most enterprise security programmes were designed before autonomous agents became mainstream. Tool permission governance, MCP security validation, agent memory controls, and workflow security testing are not yet standard practice. Most organisations deploying agents are doing so without systematic security review.
Key OWASP mapping: LLM06:2025 Excessive Agency, LLM07:2025 System Prompt Leakage.
Enterprise AI increasingly relies on Retrieval-Augmented Generation — AI systems that retrieve information from internal knowledge bases before responding. This creates a new attack layer: corrupting what gets retrieved. Retrieval poisoning, context poisoning, unauthorised retrieval, and cross-tenant leakage are all active threat categories that sit below the model layer and above the data layer — a gap that traditional security controls on either side don't adequately address.
Why coverage is low: Data access controls govern who can read files. They don't automatically govern which chunks get retrieved from a vector store. RAG-specific controls — chunk-level access control, retrieval scope validation, knowledge base isolation — are not yet standard in enterprise security programmes.
Key OWASP mapping: LLM08:2025 Vector and Embedding Weaknesses, LLM02:2025 Data Leakage.
AI systems extract information from context windows, retrieved documents, and fine-tuning data and reproduce it in outputs — often in ways that bypass traditional DLP controls because the exfiltration is semantically generated text, not file transfer or network egress. Prompt leakage, training data memorisation, cross-tenant data disclosure, and sensitive document exposure through RAG are all active risk categories with documented real-world incidents.
Why coverage is higher than agents and supply chain: Enterprises have mature data classification and DLP programmes that partially address this domain. The gap is in AI-specific controls: output monitoring for semantic data disclosure, AI-specific DLP rules, and prompt log analysis.
Key OWASP mapping: LLM02:2025 Sensitive Information Disclosure, LLM06 cross-system data exposure.
Few organisations build their own foundation models. Most deploy AI through a supply chain of third-party models, APIs, plugins, MCP servers, open-source frameworks, and fine-tuned derivatives. Each dependency is a potential attack vector. Model theft — extracting proprietary capability through repeated querying — is a growing concern. Dependency poisoning, plugin compromise, and vendor security failures are increasingly treated by CISOs as supply chain risk analogous to software dependency attacks.
Why this is the most underestimated risk: AI supply chain security doesn't yet have a mature vendor risk management framework equivalent. Most procurement processes evaluate AI vendors on performance metrics, data handling terms, and SLAs — not model security, inference-time attack resilience, or update change management.
Key OWASP mapping: LLM09:2025 Misinformation, LLM05:2025 Improper Output Handling, supply chain vectors from OWASP AI Exchange.
Not every AI security incident starts with a technical exploit. A significant proportion originates from governance failures: AI systems deployed without security review, agents operating without defined scope, no inventory of AI systems, no incident response procedures, unreviewed third-party AI vendors, and regulatory obligations not yet mapped to AI-specific controls. AI adoption is outpacing governance maturity across all industry sectors.
Why governance scores moderate despite critical rating: Most enterprises have general governance processes — risk management, compliance frameworks, vendor assessment — that partially translate to AI. The gap is in AI-specific governance: dedicated AI inventory, AI risk classification, AI-specific incident response, and agent-level permission governance.
Key framework mapping: NIST AI RMF GOVERN 1.1–6.2, EU AI Act Article 9 (risk management system), ISO/IEC 42001.
Coverage scores are calculated using a weighted model that reflects the current risk profile of enterprise AI deployments. Agent and governance domains carry the highest weights because they represent the largest coverage gaps and the fastest-growing risk categories. Prompt security carries a lower weight than its public prominence might suggest — it is the most mature category and most enterprises have at least basic controls in place.
Applying the weighted model to the domain scores above produces a cross-industry weighted average of approximately 48/100 — consistent with the interpretation that most enterprises are covered against roughly half the MITRE ATLAS techniques relevant to their AI deployments, with significant variance by sector, company size, and AI maturity level.
Interpretation: A score of 48/100 does not mean 52% of attacks will succeed. It means organisations have not addressed the controls that would mitigate 52% of relevant MITRE ATLAS techniques. Some of those unaddressed techniques may never be exploited. Others are actively being used by adversaries today — particularly in the agent abuse and supply chain categories.
Industry coverage scores reflect the intersection of existing security maturity (which varies significantly by sector), AI adoption pace (faster in technology and financial services than in legal and manufacturing), and regulatory pressure (highest in healthcare and financial services). Technology companies score highest primarily because of existing DevSecOps culture and security testing investment — not because of AI-specific controls.
| Industry | Coverage Score | Maturity Tier | Primary Strengths | Primary Gaps |
|---|---|---|---|---|
| Technology & SaaS | 72 |
Managed → Optimized |
Security testing, DevSecOps, monitoring | Agent supply chain, MCP security |
| Financial Services | 64 |
Managed | Governance, IAM, compliance processes | Agent security, runtime monitoring |
| ️ Government | 61 |
Managed | FedRAMP controls, formal security frameworks | AI-specific testing, agent governance |
| Healthcare | 54 |
Developing → Managed |
Access controls, HIPAA compliance processes | Prompt injection testing, RAG access controls |
| ️ Legal & Professional | 52 |
Developing → Managed |
Data classification, confidentiality controls | AI security testing, agent governance, runtime |
| Manufacturing | 49 |
Developing | OT/IT security baseline | AI-specific controls broadly, agent security |
| Retail & E-commerce | 46 |
Developing | Fraud detection, PCI DSS controls | RAG security, agent governance, supply chain |
| SMB Average | 38 |
Ad Hoc → Developing |
Agility, modern cloud-native stack | Governance broadly, no dedicated security team |
† Coverage scores are structured analyst estimates based on framework analysis and typical deployment patterns. Individual organisations may score significantly above or below their industry average based on security programme maturity, AI adoption pace, and investment level.
Based on the NIST AI RMF conceptual structure and adapted for AI-specific security practice, the five-level maturity model provides organisations with a progression framework from baseline awareness to industry-leading AI security operations. Most enterprises currently operate at Level 2 (Developing) to Level 3 (Managed).
AI is deployed without systematic security consideration. Controls are absent or entirely reactive. No AI inventory exists. No incident response procedures for AI-specific events. This is the default state for most organisations at the moment they first deploy generative AI.
Basic security controls are in place. AI awareness has entered the security conversation. Some testing exists but is not systematic. Governance is primarily reactive — policies are written after incidents rather than before deployment.
A formal AI security programme exists. Security testing is conducted before deployment and on a regular cadence. Governance includes risk assessment, documented ownership, and compliance mapping. Monitoring is present but may not be AI-specific.
Continuous security testing, runtime monitoring, and formal ownership assignment are standard practice. Red teaming is conducted at least annually. AI security metrics are tracked and reported to leadership. Agent security and RAG security have dedicated controls.
AI security is a first-class discipline with dedicated resources, specialised expertise, and continuous improvement driven by benchmark data and proprietary threat intelligence. Automated governance, continuous red teaming, and benchmark-driven improvement cycles define operations at this level. A small minority of organisations currently achieve this maturity.
Derived from the intersection of MITRE ATLAS technique frequency, OWASP GenAI community prioritisation, and observed enterprise incident patterns. These risks represent the threats most likely to result in a material security incident for an enterprise AI deployment in 2026.
The foundational AI attack. Direct and indirect variants both active.
Adversary redirects autonomous agent objectives via instruction override.
Agent manipulated to misuse legitimate API and tool access.
PII, PHI, IP extracted through AI outputs or retrieval disclosure.
Malicious content injected into RAG knowledge base corrupts AI outputs.
Agent granted more capability than required for its defined function.
Third-party model, plugin, or MCP server becomes an attack vector.
Proprietary model capability extracted through repeated adversarial querying.
AI deployed without policy, oversight, inventory, or incident response.
Employees use unapproved AI tools that process sensitive enterprise data.
At 41/100, agent security is the lowest-scoring domain — and the domain with the fastest-growing enterprise adoption. Organisations are deploying autonomous agents for customer service, sales outreach, code generation, and operations without the security controls that the attack surface requires. Tool permission governance, MCP security validation, and agent memory controls are not yet standard practice in any industry sector.
The critical asymmetry: The blast radius of a compromised AI agent is dramatically larger than a compromised chatbot. A chatbot that misbehaves generates a bad response. An agent that is hijacked can send emails, modify records, call external APIs, and trigger business processes — all using its own legitimate credentials, producing no authentication anomalies for traditional security monitoring to detect.
AI deployment is accelerating faster than governance maturity across every sector assessed. The pattern is consistent: AI tools are adopted by individual departments or engineering teams, then security and compliance teams are asked to assess and govern systems that are already in production. Pre-deployment security review — the most efficient point to address AI risk — is not yet standard practice outside of technology-sector organisations.
At 39/100, AI supply chain security scores below even agent security — despite the fact that most enterprise AI systems are built almost entirely from third-party components. Foundation models, inference APIs, vector databases, orchestration frameworks, and MCP connectors are all external dependencies with their own security postures, data handling terms, and vulnerability exposure. Yet most enterprise AI vendor assessments evaluate SLAs, data handling, and pricing — not model security, inference-time attack resilience, or supply chain transparency.
Enterprise RAG adoption has outpaced the development of RAG-specific security controls. Data access controls govern who can read files. They don't automatically govern which chunks a vector retrieval system returns, whether cross-tenant isolation is enforced, or whether the knowledge base has been integrity-validated. These are architectural security problems that require RAG-specific tooling and controls that most enterprises have not yet implemented.
Autonomous agent deployments will reach critical mass in enterprise environments in 2026–2027. The security failures that result — and there will be documented, public failures — will drive the emergence of agent security as a recognised discipline, with dedicated tooling, standards, and practitioner expertise analogous to how cloud security emerged from cloud adoption in 2013–2016. OWASP's Agentic Security Initiative is the early signal of this categorisation.
Enterprise security questionnaires will expand to include AI-specific vendor assessment criteria: model provenance, training data governance, inference security, and model version change management. Vendors who cannot answer these questions will face procurement friction. This shift mirrors what happened with cloud security questionnaires in 2015–2018 and SOC 2 requirements in 2018–2022.
Regulatory pressure (EU AI Act, US Executive Order on AI), insurance requirements, and customer security questionnaires will drive AI red teaming from an advanced practice to a standard expectation for any organisation deploying high-risk AI systems. The question will shift from "should we red team our AI?" to "how often are you red teaming, and what is your methodology?"
The EU AI Act's Article 9 risk management system requirements, combined with NIST AI RMF MEASURE and MANAGE function obligations, will drive runtime monitoring from a security best practice to a compliance requirement for high-risk AI system operators. The monitoring gap — currently one of the largest in the AI security landscape — will close rapidly under regulatory and contractual pressure.
The question "what is our CVSS average?" has been a standard board-level security metric for a decade. By 2027, equivalent AI security metrics — MITRE ATLAS coverage percentage, agent security maturity level, RAG security posture score — will enter regular board and executive reporting. This benchmark is an early contribution to that emerging measurement ecosystem.
The 2026 AI threat landscape is no longer dominated solely by prompt injection. Enterprises face a broader attack surface encompassing autonomous agents, retrieval systems, supply chains, governance failures, and increasingly complex AI ecosystems — most of which their current security programmes were not designed to address.
This inaugural benchmark establishes a structured framework built on six authoritative sources and provides a reproducible methodology that becomes more precise as proprietary data accumulates. The Q4 2026 edition of this report will incorporate real usage data from the AIZA-HexTyx free tool platform, transforming analyst estimates into statistically grounded benchmarks.
"The organisations that will lead AI security in 2027 are not the ones that deploy AI most aggressively. They are the ones that measure their posture, benchmark against peers, and systematically close the gaps that measurement reveals."
AIZA-HexTyx Research, 2026 — AI Security Threat Landscape & Coverage BenchmarkThe tools to measure that posture are available now — free, and built specifically for the AI security challenges this report describes.
Citation: AIZA-HexTyx. (2026). AI Security Threat Landscape & Coverage Benchmark 2026 (Version 1.0). AIZA-HexTyx Research. https://hextyx.com/ai-security-benchmark-report-2026.html
Licence: Free to cite with attribution. Charts and figures may be reproduced with "Source: AIZA-HexTyx AI Security Benchmark 2026 (hextyx.com)" credit line.