Corporate Member Cye’s 2026 report finds UK cyber security maturity below the global average, highlighting a persistent gap between governing risk and managing it in practice.
The UK ranks seventh among the countries assessed for cyber security maturity in Cye’s 2026 Global AI and Cyber Maturity Report, scoring 2.30 out of five, below the global average of 2.35. This gap widens the blind spot security leaders are faced with in the era of agentic AI.
Based on more than 2,400 assessments across 21 countries and 16 industries, the report examines how effectively organisations govern and manage cybersecurity and AI risk.
Beyond the UK ranking, the report reveals a wider global challenge: organisations are better at establishing governance than translating it into action that reduces risk. As AI adoption accelerates, the question is no longer just whether organisations have the right policies, but whether their security controls are working in practice.
The gap between policy and practice
Cye assessed organisational maturity across the functions of two frameworks: the NIST AI Risk Management Framework (AI RMF 1.0) and the NIST Cybersecurity Framework (CSF 2.0).
Globally, AI RMF’s Govern function, which focuses on establishing policies, roles and accountability, scored 2.46 out of five, compared with 2.22 for Manage, which covers managing AI risks in practice. A similar pattern emerges in traditional cybersecurity: the CSF’s Protect function, which focuses on implementing safeguards to manage cybersecurity risk, scored just 2.18, the lowest for the second consecutive year.
Together, these findings suggest that organisations are more mature in setting direction and policies than in putting measures into practice to reduce risk.
The implication is significant: having governance structures in place does not necessarily mean organisations are reducing their exposure.
AI is amplifying existing weaknesses
AI is creating new attack surfaces, from prompt injection to insecure infrastructure and unmanaged third-party models. But the bigger challenge may be how AI amplifies weaknesses that security teams have struggled to address for years.
The report highlights familiar security weaknesses, including outdated technologies, exposed administrative interfaces and insufficient monitoring. AI doesn’t create these problems, but it can make them harder to contain as attackers use automation to identify and exploit vulnerabilities at greater speed and scale.
Meanwhile, employees are adopting AI tools faster than organisations can establish visibility and control over their use. This can leave security teams unaware of which tools are being used, what data they can access and where new risks are emerging.
Shadow AI exposure is particularly pronounced in specific sectors: 71% of assessed transportation organisations and 62% of energy organisations showed evidence of AI use alongside below-median AI governance. In financial services, the figure was just 5%.
The risk goes beyond knowing which AI tools employees are using. These tools can access sensitive data, connect to identities and critical systems, and introduce dependencies on external models, APIs and services that traditional supplier assessments may not fully capture.
Security teams need to understand where AI is being used, what it can access and whether the controls around it are effective. Without that visibility, assessing the potential impact of a compromise becomes much harder.
The emergence of agentic AI adds another dimension to this challenge. As organisations adopt AI systems that can access data, use connected tools and take actions with increasing autonomy, the potential consequences of inadequate security controls grow. Organisations need to understand not only where AI is being used, but what these systems can access, what they are permitted to do and whether the safeguards around them are effective.
This makes the gap between governance and execution even more significant. Policies can define how AI should be managed, but organisations need the visibility, controls and ongoing validation to ensure those policies translate into practice.
Regulation is evolving. Is security practice keeping pace?
The regulatory landscape is evolving alongside AI itself. In May 2026, new regulations required the Information Commissioner’s Office (ICO) to develop a code of practice covering the use of personal data in AI and automated decision-making. More recently, in October, the ICO announced a call for evidence on the data protection risks of agentic AI, reflecting growing scrutiny of systems that can take actions autonomously.
For cyber professionals, the message is clear: regulatory compliance matters, but it is only part of the challenge. Organisations also need visibility into how AI is being used, the risks it introduces and whether their controls are effective in practice.
Three priorities for cyber professionals
Cye’s report sets out seven recommendations for improving AI and cyber maturity. As AI systems become more capable and take on more complex tasks, organisations need to move beyond defining how AI should be governed to demonstrating that its risks are being managed effectively.
Three priorities stand out for security professionals looking to turn governance into measurable risk reduction:
- Know where AI is being used. Inventory AI tools, models and services, including Shadow AI, and assign clear executive ownership for AI risk.
- Extend security controls to AI dependencies. Address foundational security weaknesses and assess the risks associated with AI models, training data, updates and third-party services.
- Test whether controls work. Monitor AI systems, exercise realistic incident scenarios and measure whether controls are reducing exposure. Treat regulatory compliance as a baseline, not the end goal.
From AI adoption to AI readiness
AI is changing the pace and scale of cyber risk, but the fundamentals of security remain the same: understand your exposure, prioritize the risks that could most impact your business and act to reduce them.
For cyber professionals, maturity is not defined by the policies an organisation puts in place, but by its ability to turn them into action and demonstrably reduce risk.
As AI adoption accelerates, cybersecurity maturity will increasingly depend on an organisation’s ability to manage the risks of AI itself, while ensuring its security controls work in practice. This becomes even more important as AI agents take on more complex work and gain the ability to act on information and interact with business systems.
The challenge is not simply to adopt AI, but to do so securely. Organisations need to understand their exposure, prioritise the risks that most impact their business, and validate that the measures they put in place are reducing risk. The same principle applies to AI agents: their value depends not only on what they can do, but on the context, safeguards and oversight that make their use trustworthy.
As AI agents begin taking on more of cybersecurity’s hidden work, the question is how to harness their potential while keeping risk under control. Read Cye’s blog, AI Agents Are Taking on Cybersecurity’s Hidden Work. But Can We Trust Them?, to explore what makes AI agents trustworthy and how security teams can use them to move from insight to action safely.
Download the report
Explore findings from 2,400+ assessments across 21 countries and 16 industries, and discover seven recommendations for strengthening AI governance, addressing security gaps and turning policy into measurable risk reduction.
[Download the full report]
