As enterprise AI moves from pilot projects into production, many organizations are discovering that the biggest obstacles aren’t model performance or investment. They’re security, governance and compliance.
To better understand those challenges, Protegrity released The State of AI Friction: Why Enterprise AI Deployment is Slower, Costlier, and More Limited Than Expected, an independent research report produced by Enterprise Management Associates (EMA). Based on a survey of IT and security leaders, the report finds that more than 82% of organizations have delayed AI deployments because of security or compliance reviews, while more than 80% have deployed AI with reduced functionality due to governance concerns. The findings suggest that operational processes, rather than technology limitations, are increasingly determining how quickly enterprises can put AI into production.
“AI has quickly become a business imperative, but many organizations are discovering that getting AI into production is far more difficult than building a proof of concept,” said James Rice, VP of Product Marketing at Protegrity. “This research helps us better understand where those barriers exist and what they’re costing enterprises. The findings show that security, governance, and compliance have become critical business considerations that can either accelerate AI adoption or slow it dramatically. Organizations that address this friction will be in a much stronger position to realize AI’s full value.”
The findings indicate that while enterprise AI investment continues to accelerate, organizations are struggling to move projects from pilot to production without delays or compromises. According to the research:
- 82.9% of organizations say security or compliance reviews have delayed AI projects from reaching production.
- More than two-thirds of delayed AI initiatives remain stalled for at least one month, with nearly 30%delayed four months or longer.
- 81.6% report deploying AI in a diminished state because of security concerns, reducing agent autonomy or restricting access to critical enterprise data.
- 47.4% identify reducing manual audit and compliance costs as the most valuable business outcome of improved AI data security and governance.
- Nearly 70% of organizations already operate AI agents capable of writing to databases or triggering APIs, yet only 19.7% report deploying highly autonomous AI systems, highlighting the growing gap between AI capability and governance readiness.
- 91.5% of respondents say solutions that provide AI-ready data by embedding protection directly into workflows would be very or extremely valuable, reflecting growing demand for security architectures that move at the pace of AI.
The findings point to what EMA calls the “AI friction tax,” the hidden operational costs that accumulate as AI projects move from prototype to production. Rather than being limited by AI models or budgets, many organizations are running into security reviews, governance processes and data access controls that weren’t designed for today’s AI-driven environments.
The report suggests the challenge is becoming more pronounced as enterprises deploy increasingly autonomous AI systems. Nearly 70% of respondents already operate AI agents capable of taking actions such as writing to databases or triggering APIs, yet only 19.7% report deploying highly autonomous AI in production. Security and governance concerns continue to limit what those systems can actually do, reducing business value even after deployment.
“Security, governance and compliance have become operational bottlenecks for enterprise AI,” said Chris Steffen, Vice President of Research, Information Security at EMA. “Organizations are investing aggressively in AI infrastructure, but many are still relying on governance models designed for traditional applications. The result is delayed deployments, reduced agent autonomy and higher operational costs that compound across every AI project.”
The research also points to a shift in how organizations are thinking about protecting AI workloads. Instead of relying on manual approval processes or perimeter-based security, enterprises increasingly want data protection embedded directly into AI workflows so policies are enforced where data is used. According to the survey, 91.5% of respondents say solutions that provide AI-ready data with embedded protection would be very or extremely valuable, underscoring the growing demand for security that can keep pace with cloud-native infrastructure, Kubernetes deployments and agentic AI.
