Skip to content
Marsanne Studio
← Back to home
← The AI watch

AI watch by topic

AI and cybersecurity

Most small and medium businesses in France and Spain are already using AI, often informally: 97 % of Spanish SMEs have adopted it, according to a report cited by Emprendedores, while France’s official France Num barometer puts adoption at 40 % of micro-businesses and SMEs and 53 % among SMEs specifically. This rapid uptake is running ahead of formal rules: in Spain, 39 % of organisations have no formal AI usage policy, and across four European countries two-thirds of IT professionals report shadow AI within their organisation. Alongside new risks, from leaked data to AI-accelerated attacks and ungoverned autonomous agents, some companies are also using AI to strengthen their defences, with security teams reporting faster and more accurate incident handling.

Shadow AI: usage outpaces company policy

Adoption of AI in small and medium businesses has moved faster than company policy. In Spain, 97 % of SMEs already use AI, according to a report by OpenAI cited by Emprendedores, with 59 % doing so regularly; yet 39 % of these organisations still have no formal usage policy, and the UK’s National Cyber Security Centre found that 71 % of employees use AI tools without their employer’s approval, a pattern most pronounced in firms with fewer than ten staff. In France, the official France Num barometer puts AI adoption at 40 % of micro-businesses and SMEs in 2026, rising to 53 % among SMEs specifically. A survey of IT professionals across France, the UK, Germany and Spain found two-thirds reporting shadow AI within their organisation, persisting despite explicit rules in 12 % of cases.

Our summaries: Emprendedores, Comarketing-News, Direction générale des Entreprises

Everyday prompts are already leaking sensitive data

Everyday use of AI chatbots is already exposing sensitive company information. Check Point Software Technologies found that around one in 80 prompts submitted by Spanish SMEs to generative AI platforms carries a high risk of leakage, and that 7.5 % of prompts contain sensitive information, according to a report cited by Emprendedores. Check Point’s own AI Security Report put the global share of high-risk prompts, those sending sensitive or regulated data to external services, at 4 % in 2026, up from 2 % a year earlier, with Europe recording the highest regional rate at 3.95 %, against a 3.45 % global average. A survey of 2,600 executives in 13 countries for SAP and Oxford Economics found 48 % of organisations had already experienced data leaks or exposed intellectual property linked to unauthorised AI tools, and 38 % had faced resulting security vulnerabilities.

Our summaries: Emprendedores, IT for Business, PortalERP

Attackers are already using AI to move faster

AI is also changing the pace at which attackers work. At Monaco’s Assises de la sécurité, insurer Covéa reported finding all twelve of its 2026 catastrophic-level vulnerabilities using AI, against two in the whole of 2025, while bug bounty reports at gaming group FDJ United increased markedly from May 2026, with about half of submissions deemed admissible, according to the company. More broadly, security researchers running AI agents continuously have driven spikes of around 70 % in valid high or critical bug bounty reports following the release of new AI models. A SoSafe survey of 150 cybersecurity leaders found 76 % of French respondents already observing attackers actively using AI tools, with voice phishing said to account for 80 % of observed attacks. Separately, 61 % of chief information security officers surveyed said AI had directly increased the risk of ransomware attacks.

Our summaries: IT for Business, Alliancy (1, 2), Journal du Net

Autonomous agents outpace company governance

Companies are deploying autonomous AI agents faster than they can govern them. McKinsey research cited in trade press found more than 60 % of organisations already experimenting with AI agents, these agents outnumbering human employees by roughly 82 to one in a typical company, and 97 % of agents holding excessive access privileges. A Cloud Security Alliance study found nearly two-thirds of organisations had suffered a security incident linked to AI agents, 92 % had staff who had installed AI locally with access to sensitive encryption keys, and 82 % hosted agents with no formal management. Gartner expects up to 40 % of enterprise applications to embed specialised agents by the end of 2026, against under 5 % in 2025, while an IFS study found 43 % of operational teams had adopted autonomous agents within twelve months, but only 11 % had validation procedures in place for critical processes.

Our summaries: Journal du Net, Solutions Numériques, Silicon.fr, LeMagIT

Where AI is already strengthening defences

AI is also reinforcing some companies’ defences. At French engineering group SPIE, which receives around 43,000 security alerts a month, an AI agent built by Sekoia was tested from July 2026 on part of that volume: across roughly 10,000 alerts handled in September, 96 % of the agent’s verdicts were left unchanged by human analysts, and the security operations team worked considerably faster, according to Sekoia, though the tool still missed most genuine threats, confirming only two of 411 alerts it flagged as such. Across its wider base of 1,000 clients, Sekoia reported a 90 % rate of unmodified verdicts. Separately, chipmaker Nvidia says more than 100 organisations, including Microsoft, IBM, Salesforce and Hugging Face, are already working with its Open Agent Safety Platform, designed to monitor and halt AI agents that behave abnormally.

Our summaries: Silicon.fr, IT for Business (1, 2), Ouest-France

Practical steps smaller companies are taking

Harvard Business Review notes that AI can help smaller companies strengthen cybersecurity without buying new software, drawing on free resources and capabilities already built into services SMEs already use. In Canada, cybersecurity firm VARS, part of Raymond Chabot Grant Thornton, recommends five concrete steps for SMEs: a clear AI usage policy, identity and access management, multi-factor authentication, employee awareness training, and keeping a human in the loop for decisions. Barracuda Research found that close to half of IT leaders feel their teams lack the skills to manage AI securely, and that, according to an IBM report, 68 % of organisations hit by a data breach had no policy to manage AI or detect shadow AI, prompting Barracuda to launch a dedicated protection tool for SMEs and managed service providers in October 2026.

Our summaries: Harvard Business Review, Raymond Chabot Grant Thornton, IT User

Articles cited

Another question?

Claude searches the articles in the watch and answers you, citing its sources.

Answer written by an AI model (Claude, by Anthropic) from the articles in the watch only: check the figures in the sources. Questions are recorded;learn more.

Method

Text written on 20 October 2026 by an AI model (Claude Sonnet 5, by Anthropic) from 80 AI watch articles on this theme, published between 24 September 2026 and 16 October 2026. Each paragraph links to the entries it draws on, and every number in the text was found in one of these articles before publication. The text is rewritten every week.

Other industries

Other topics