A new report from HackerOne suggests many organizations are deploying artificial intelligence faster than they are securing it. The research identifies what the company calls an AI security gap, a disconnect between the number of AI systems organizations operate and how many undergo formal security testing.
According to the report, AI adoption is accelerating across industries. Ninety four percent of respondents say they operate more AI or machine learning systems than they did a year ago. Yet testing coverage has not expanded at the same rate. Only 66% of organizations say they formally test 61% or more of their AI or ML systems, resulting in what the research describes as a 28 point AI security gap.
Security leaders working within that gap report a higher rate of security incidents tied to artificial intelligence. The study found that 89% of organizations with limited AI testing coverage experienced AI related attacks or vulnerabilities in the past year.
The research also points to a measurable financial impact. Organizations operating within the AI security gap report 70% higher annual remediation costs compared with organizations that test nearly all of their AI systems.
“AI systems are dynamic, evolving with every model update, integration, and data connection and the same is true of modern digital systems overall,” said Kara Sprague, CEO of HackerOne. “As systems become more interconnected and adaptive, risk evolves in real time. Periodic testing assumed stability. Today’s reality requires continuous testing so leaders can detect change, identify what’s exploitable, and mitigate risk before it materializes.”
The findings are based on a survey of more than 300 security leaders across six countries and highlight structural trends shaping AI risk exposure:
- AI risk compounds as deployments scale: Organizations that expanded from a small AI footprint of two systems to a larger environment of eight to 10 systems experienced 82% more attack types reported and 2.4 times higher attack costs. As AI tools connect with APIs, enterprise software and internal data sources, security exposure can increase significantly when testing practices do not scale alongside adoption.
- Testing coverage is not keeping pace: While 94% of organizations added AI or ML systems in the past year, only 66% report formally testing 61% or more of their systems. Across all respondents, 84% experienced at least one AI related attack or vulnerability in the past 12 months. Organizations testing 91% or more of their AI systems are 16% less likely to report an AI related incident than organizations with lower testing coverage.
- Shadow AI remains a material blind spot: Only 55% of organizations say they fully track unsanctioned or “shadow” AI usage across their organizations. As employees increasingly integrate AI tools into everyday work, security teams may have limited visibility into how those tools connect with internal systems and data. This lack of oversight can expand the attack surface and create additional governance and compliance challenges.
“Organizations keep adding AI systems without thinking about the blast radius,” said Luke Stephens, security researcher. “These aren’t sandboxed toys. They’re hooked into real data, real APIs, real decision-making. When something goes wrong, it doesn’t stay contained. The cost data in this report reflects what I’ve been seeing in the wild: the longer you wait to test, the more expensive it gets to fix.”
As AI becomes more deeply integrated into business operations, organizations are facing growing pressure to demonstrate oversight and accountability. Boards and regulators are increasingly asking security teams to show how AI systems are monitored, tested and governed.
The report suggests that continuous testing will be essential as AI adoption continues to expand. As organizations deploy more AI systems and connect them to critical infrastructure and data, security testing will need to evolve alongside the technology to reduce risk and maintain visibility into potential vulnerabilities.
