The Revenue Gap Between AI Capability and Privacy Investment
Enterprises are rushing AI into production faster than they can build the safeguards to protect it.
The defining fact of enterprise technology in 2026 is that AI spending is compounding at a pace privacy and governance investment simply cannot follow, and that gap is built into the way organizations decide what to fund first. Gartner reported that worldwide AI-optimized infrastructure-as-a-service spending roughly doubled over the year, reaching $42 billion, pushed by enterprises moving AI out of pilot programs and into everyday operations, and by a shift away from one-time model training toward continuous, real-time inference running around the clock. Flexera's 2026 reporting, citing Gartner, puts the growth rate of AI spending at more than three times the rate of overall IT spending, making it the fastest-growing line in enterprise technology budgets by a wide margin. Behind that number is a simple mechanism: AI deployment moves at the speed of competitive pressure and board-level urgency, while governance gets treated as something to sort out once the capability is already running. Gartner's own data shows inference has now overtaken training as the larger share of AI infrastructure spend, and the firm projects inference will keep that lead through 2027. Enterprises are committing to production-scale, always-on AI execution well before the governance frameworks needed to cover that execution are in place.
The spending asymmetry between securing AI systems and using AI to secure other systems
Enterprises spend far more money using AI to defend themselves than they spend protecting the AI systems doing the defending, which leaves the defensive AI itself as the least-protected part of the security stack. The AI cybersecurity market splits cleanly into two different jobs. One is using AI to catch threats, flag anomalies, and speed up incident response across the rest of the enterprise. The other is protecting the AI itself: the models, the training data, the inference pipelines, and the decisions those systems output. Spending on the first job outpaces spending on the second by a ratio sources put at roughly seventeen to one. That reflects a basic misunderstanding of where the new attack surface actually sits, not a budget-allocation quirk inside one line item. The exposure isn't only in the network perimeter or the endpoint anymore; it's inside the model's inference pipeline and the data flowing through it, and almost none of the seventeen-to-one spending gap is pointed there. Agentic AI makes the mismatch worse. The share of enterprise applications that embed task-specific AI agents, which can take autonomous, multi-step action rather than returning a single output, is projected to grow sharply over the next several years. But the governance frameworks most enterprises built were designed around a single model producing a static answer, not around a chain of agents negotiating and executing tasks on their own. A survey of CISOs and CIOs at large enterprises found that most lack full visibility into their own AI agent identities, and they doubt they could detect, let alone contain, a compromised agent. The governance structure is there on paper. The capability to actually govern is not.
What the gap costs when it is exploited
When AI capability outruns privacy architecture, the consequences don't stay on security conference slide decks. They have already happened, to named organizations, with costs that are now a matter of public record. Samsung Electronics found this out in 2023: within weeks of letting employees use ChatGPT, its semiconductor division suffered three separate disclosures of confidential material, source code, optimization code, and a transcribed recording of an internal meeting, before the company banned the tool. Nobody hacked Samsung. The tool worked exactly as designed, and that was the problem. Microsoft 365 Copilot carried its own version of the same lesson. In June 2025, researchers at Aim Security disclosed a flaw, tracked as CVE-2025-32711 and nicknamed EchoLeak, that let an attacker exfiltrate data from Copilot with zero clicks from the victim. Microsoft's own advisory described it as AI command injection in M365 Copilot allowing an unauthorized attacker to disclose information over a network. It is the first documented case where prompt injection was weaponized into real data exfiltration inside a production AI system. ServiceNow's AI Platform saw a comparable arc play out on a tighter timeline in 2026: a vulnerability tracked as CVE-2026-6875 was patched for hosted instances in April, with the self-hosted fix following July 13. Within five days, researchers at Defused observed the flaw being actively exploited in the wild, which separates this case from vulnerabilities that exist on paper but never get weaponized. CB Financial Services determined on May 7, 2026 that unauthorized employee use of AI had created a materiality event, and filed what appears to be the first SEC Form 8-K ever triggered by unauthorized AI use, showing how far the consequences now reach beyond security teams. Nothing was breached by an outside actor. Data sensitivity alone was apparently enough to trigger a federal disclosure obligation.
Shadow AI as the gap's most widespread expression
The most common route through the privacy gap is routine employee behavior, which most governance frameworks were never built to catch. IBM's 2025 breach report introduced shadow AI, meaning employees using AI tools outside any enterprise-governed channel, as a newly tracked incident category, and found it involved in a notable share of breached organizations, with regulatory fines resulting in roughly one in five of those cases. The underlying behavior is almost universal: a large majority of employees who use generative AI at work paste company data directly into prompts, and most of that activity happens through personal accounts the enterprise has no visibility into. That data sits entirely outside whatever data-loss-prevention tooling the organization has bought and deployed. One incident involving CISA makes the architectural point sharper than any policy document could. The employee involved knew the rules, understood the AI-use policy, and used the unauthorized channel anyway because nothing in the system actually stopped them. That is the lesson shadow AI keeps delivering: the most carefully drafted governance structure, with its ethics committees, its policy documents, its quarterly compliance reviews, cannot reach behavior that happens quietly in a browser tab the enterprise was never built to see.
Why governance investment hasn't closed the gap even where it exists
Most large enterprises now have some form of AI governance structure. Most of those structures cannot actually govern the AI those enterprises have deployed, and the distance between having a governance program and having governance capability is where the real exposure lives. Consider what explainability frameworks were built to do in the first place: trace how a single model arrived at a single output. That design assumption breaks down the moment multiple agents are negotiating and executing a multi-step task together, because there is no single output to trace back to a single cause. A billing error, a logistics failure, or a compliance breach can now emerge from a negotiation between agents that leaves no audit trail a human could actually read and reconstruct after the fact. So why would enterprises build governance frameworks that don't match the systems they're meant to govern? The governance programs most organizations run today were largely designed for a world of single-model, single-output AI, and agentic, multi-step execution arrived faster than those programs could be rebuilt around it, a matter of timing more than negligence. The documentation exists. The architecture to back it up does not, and that distinction sets up the deeper argument that follows: governance has to be built into the system itself, not maintained alongside it as paperwork.
ROI Reframes Privacy Investment as a Revenue Question
Return on investment, not new regulation, is what actually changes the calculus on privacy investment, and the data here cuts against the assumption that governance slows a company down. Grant Thornton's survey found that organizations with fully integrated AI are nearly four times more likely to report revenue growth than organizations still stuck piloting it, 58% versus 15%. So that single comparison reframes the build-first, govern-later sequence as something closer to economically self-defeating than merely risky. The defensive case for AI is just as telling. IBM's breach-cost data shows organizations that use security AI and automation extensively save $1.93 million on average compared to organizations using none, and they identify and contain breaches faster when they do. Well-deployed AI functions as a privacy control in its own right, which complicates any argument that frames AI capability and privacy investment as two things pulling in opposite directions. But what if the recognition of all this still isn't enough to move budgets? That appears to be exactly where many enterprises sit today. A survey of large enterprises across the Americas and Europe, conducted in April and May of 2026, found that while most had increased their investment in AI-specific security tools, a majority still said their current AI-related cybersecurity budgets were insufficient. The awareness is there. The resourcing to match it is not, and that gap between knowing and funding is precisely what the rest of this argument is built to close.
Why privacy has to be built into AI architecture rather than added to it
Layering more governance on top of an existing AI deployment will not close this gap. Closing it requires treating privacy as a design constraint from the start, built into the architecture before anything ships, not bolted on after the fact as remediation. Look across every incident named so far, Samsung, Microsoft's Copilot, ServiceNow, CB Financial Services, and a pattern repeats without exception: a capable AI system ran inside an architecture that did not actually enforce the privacy constraints the organization assumed it had. The governance existed on paper in every one of these cases. The architecture is what let the failure happen anyway. That is the structural limit of any purely post-hoc control. Policies can restrict what a user is authorized to do, but they cannot stop data from being processed by a system that was never built to keep that data contained. The alternative is architectural: systems designed so that user data never leaves a controlled environment, is never retained for model improvement, and is never accessible to the provider running the system. Privacy becomes a property of how the system is built. This is the position Confidant is built on, that users should not have to choose between AI capability and data protection, that privacy belongs in the architecture rather than layered on top of it, and that the data users bring to an AI system should stay theirs, not collected, not monetized, not exposed somewhere in the inference pipeline. One might object that privacy-preserving architecture has to trade away capability to get that protection. The ROI data says otherwise: organizations that built governance into deployment before scaling returned more from their AI investment, not less, which undercuts the assumption that protection and performance sit on opposite ends of a seesaw. Agentic AI only raises the stakes on getting this right early. As inference becomes the dominant workload and autonomous agents start executing multi-step tasks with real consequences attached, the window for retrofitting privacy controls after the fact narrows with every deployment cycle that passes.
What closing the gap requires from enterprise decision-makers
The enterprises that close the revenue gap between AI capability and privacy investment will be the ones that treat privacy architecture as a procurement requirement and a prerequisite for scaling, not a compliance review tacked onto the end of a deployment. The default sequence most organizations still follow, deploy first, discover the exposure later, remediate after that, has a documented failure record. It is the exact sequence that produced Samsung's company-wide ban, the delayed disclosure in the NSW incident, and the CISA shadow AI case, and it is the same sequence now leaving agentic AI systems running without any usable audit trail. Access controls need to extend to the AI models themselves and the data those models touch, not just to the infrastructure sitting around them. Most organizations currently apply no access controls to their AI models at all, and among organizations that have already suffered an AI-related breach, the large majority lacked proper access controls on those models, a gap visible directly in the breach investigations themselves. Vendor selection belongs in this same category of decision now. Choosing an AI provider means choosing whether your data gets retained, whether it trains someone else's model, or whether it stays inside an environment your organization actually controls, and that choice carries real consequences for breach cost, regulatory exposure, and the return an enterprise ultimately sees on its AI investment. The ROI data from Grant Thornton and KPMG makes the business case: the governance-first organizations in that data aren't trading growth for protection. They are the ones reporting the growth, and the revenue gap in question is the gap between what governance-mature organizations and governance-immature organizations actually get back from the same investment, with the data so far saying that gap runs in favor of the organizations that build privacy in from the start.
