New international research reveals that almost half of senior IT leaders say their teams lack the skills to secure and govern the AI technologies already used in the business

Key takeaways

• New Barracuda research shows that 44% of the most senior IT leaders in organisations with 100 to 500 employees, and 49% of those in organisations with 500 to 1,000 employees, rank AI security and governance as one of their top three capability gaps.
• The skills challenge is most pronounced in organisations where AI is integrated into email, business operations and workflows.

Organisations are rapidly adopting AI, but many lack the expertise needed to manage the security, governance and compliance risks that come with it.

Barracuda recently surveyed IT and security leaders in organisations with between 100 and 2,000 employees in the U.S., EMEA and APAC. The survey asked: “Where does your security team currently lack the skills or expertise needed to respond effectively?”

The findings reveal widespread skills gaps in AI security and governance, especially among midmarket organisations and businesses embedding AI into email systems, operational workflows and enterprise systems.

AI security and governance rank among the highest skills gaps overall

Nearly 4 in 10 (38%) of the organisations surveyed overall say their teams lack the skills or expertise needed to secure and govern the AI tools being used across the business.

This includes 44% of CIOs in organisations with 100 to 500 employees and 49% of those in organisations with 500 to 1,000 employees.

AI security and governance ranked as the third-largest skills gap identified in the research. Only two challenges scored higher: responding to AI-powered phishing and social engineering attacks (47%) and defending against identity-based attacks (39%).

Why senior IT leaders are particularly concerned

The senior IT perspective is particularly important because these roles have broad visibility across people, processes, technology, and business strategy. They are often among the first to see where AI adoption is outpacing governance, policy development and risk management.

Their heightened concern also shows that AI governance is no longer a niche cybersecurity issue confined to security teams. It is increasingly a business-wide leadership challenge that requires oversight across technology, compliance, risk management, legal, HR, and executive leadership functions.

Scale and complexity make governance harder

The research suggests that AI security and governance become more difficult as organisational complexity increases.

Among the larger midmarket organisations surveyed (with 1,500 to 2,000 employees), 47% reported a lack of AI governance expertise, compared with 38% of organisations with 100 to 500 employees. The difference is not dramatic, but it is revealing.

As organisations grow, they typically introduce more applications, users, data sources, and business processes, with more integrations between them. They may also face a greater variety of regulatory and compliance obligations.

In these environments, governing AI not surprisingly becomes harder. Organisations need visibility into which AI tools are being used, what data those tools can access, how outputs are being used, and who is responsible for oversight. Maintaining consistent governance standards across a larger and more diverse environment can be challenging even for well-resourced teams.

AI-connected email workflows raise the stakes

Another interesting finding relates to organisations where AI is becoming operationally embedded.

As organisations increasingly deploy AI agents to connect email, CRM, HR, finance, and customer support systems, AI governance becomes significantly more complex. 42% of organisations that use AI to integrate email with workflows reported concerns about AI governance expertise. That compares with 35% of organisations where email remains a human-only process.

This finding highlights a shift in how organisations should think about AI risk. When AI becomes connected to business operations, the potential impact expands significantly. AI may gain access to sensitive information, influence business decisions, automate operational processes, or initiate actions across connected systems.

At that point, AI governance extends beyond monitoring prompts and AI-generated outputs. It becomes a question of controlling how AI accesses data, interacts with business systems, influences decisions, and initiates actions.

Managed service providers support worried customers

The findings show that organisations working with managed service providers (MSPs) are more likely to cite a lack of AI security and governance expertise. 40% of MSP customers expressed concern about such skills gaps, compared with just 30% of the small minority of organisations that do not use MSPs and have no plans to do so.

This suggests that many organisations recognise they do not have all the expertise required in-house and are increasingly turning to MSPs for support with AI security, governance and risk management.

Interestingly, organisations that do not use MSPs and have no plans to do so report their top skills challenge as “translating technical risks into business impact.”

In other words, they recognise that they struggle to understand how technical risks — which would include unprotected and unmanaged AI — could impact the business. This may explain why they don’t see the need to find outside help. Organisations that use MSPs ranked this skills gap lowest of all.   

No organisation is immune

AI security governance skills challenges are not confined to a specific industry or geography. At least 3 in 10 respondents across the industries surveyed report insufficient expertise to secure and govern business AI use. The issue also ranked among the top three skills concerns across most countries included in the research.

How to close the capability gap

As AI adoption continues, a lack of robust security and governance will expose organisations to increasing risk. Employees may upload confidential data into public AI platforms; AI agents may access information they don’t need; sensitive data may be included in prompts, outputs, or training datasets; and organisations may lose visibility over where business data is being processed or stored.

The solution is not to restrict the use of AI — the business benefits are immense, and employees are likely to find workarounds that expose the organisation to further risk.

Instead, organisations need practical, scalable ways to adopt AI safely, without slowing innovation or losing visibility and control over how business data is used. Solutions such as Barracuda AI Data Security help organisations and MSPs maintain visibility and control over how employees use business data in AI, supporting secure AI adoption without slowing innovation.

Methodology

Barracuda surveyed 2,000 mid- to senior level IT and security decision-makers in IT and business roles in organisations with between 100 and 2,000 employees from a broad range of industries in the U.S., UK, France, DACH (Germany, Austria, Switzerland), Benelux (Belgium, the Netherlands, Luxembourg), the Nordics (Denmark, Finland, Norway, Sweden), Australia, India, and Japan. The survey was undertaken for Barracuda by independent research agency Arlington Research.