Gigamon survey: AI governance tops CISO agenda as hybrid AI spreads
Gigamon has published its fourth annual Hybrid Cloud Security Report, drawing on responses from more than 1,000 security and IT leaders including 307 CISOs across Australia, France, Germany, Singapore, the UK and the United States. The headline finding is unambiguous: governance of AI systems has overtaken traditional perimeter concerns at the top of the CISO agenda, with 80 percent of respondents citing inadequate governance around unsanctioned AI use as their leading challenge to securing data.
The report frames the shift as structural rather than cyclical. Organisations are no longer standardising on a single AI model or vendor. Instead, they are assembling combinations of frontier, open-weight, specialised and privately hosted models to balance performance, cost and data-sovereignty requirements. Gigamon calls this pattern "Hybrid AI," drawing an explicit parallel to the fragmentation that cloud adoption produced in the previous decade. The result is a proliferating mesh of model-to-model, model-to-application and model-to-data connections that security teams must monitor and govern, often without the tooling to do so.
The visibility gap
The figures on visibility are striking. Some 76 percent of respondents say limited visibility into AI-driven traffic is a major barrier to securing AI adoption, while 45 percent are prioritising improved visibility into AI-driven data flows across hybrid cloud infrastructure. The scale of the problem is compounded by a tool-proliferation paradox: 88 percent of CISOs report deploying new detection and visibility tools over the past year, yet breaches rose 18 percent year on year. The data suggest that adding tools without improving the underlying network-derived telemetry layer is failing to contain risk.
Grant Yacomeni, CISO at Gigamon, put it directly: "You cannot govern what you cannot see." The sentiment captures the core commercial argument in the report, which positions Gigamon's Deep Observability Pipeline as the answer. Separately, the survey found that 87 percent of CISOs regard deep observability as foundational to securing AI deployments.
Among organisations that experienced a breach over the past year, 83 percent reported AI-related security incidents, with unsanctioned AI use and internal data leaks into AI systems each accounting for 30 percent of incidents. The boardroom dimension is also sharpening: seven in ten CISOs are concerned that weak board-level understanding of AI risks could allow adoption to outpace security readiness. More than one in four CISOs expressed concern about losing their job following a serious cyber incident, a signal of growing personal accountability at the leadership level.
Market and regulatory context
The findings land at a moment when regulators are beginning to codify AI governance expectations. The EU AI Act's obligations for general-purpose AI providers began phasing in during 2026, and the UK's AI Safety Institute has been pressing for greater transparency from developers of frontier models. NIS2, which took effect across EU member states in late 2024, places explicit obligations on organisations to manage supply-chain and third-party risk, categories that now extend to AI model vendors and API providers.
The deep-observability and network-telemetry category where Gigamon operates is contested. Established security-operations platform vendors and SIEM providers have moved to incorporate flow and packet-level telemetry into their platforms, while cloud-native observability startups have attracted substantial venture funding on the premise that agent-based approaches can match packet-level fidelity at lower operational overhead. The survey data, produced by Gigamon, should be read with that commercial context in mind.
Two findings merit particular attention from infrastructure buyers: 36 percent of CISOs identified east-west lateral traffic as the area of greatest breach risk, reflecting the challenge of monitoring model-to-model communication inside hybrid cloud environments; and 86 percent said encrypted-traffic visibility is critical for post-quantum cryptography readiness, a figure that will become more operationally pressing as NIST's PQC migration timeline advances toward its 2030 federal-agency deadline.