Heimdal Survey: Executive Overconfidence in AI Risk Management Outpaces Technical Team Concerns

Key Findings

• Executive confidence vastly outpaces frontline reality. In the US, 29% of C-suite and VP respondents say AI risk is under control versus only 7% of mid-level practitioners. The UK shows a similar pattern at 18% versus 11%.

• AI adoption has nearly doubled security readiness. Only about 40% of teams rate their security stack as prepared for AI-related threats.

• ChatGPT and Microsoft Copilot are already embedded across most organizations. ChatGPT runs in 72% of UK and 69% of US IT environments. Copilot is in 68% of UK and 59% of US environments.

• Better visibility creates more concern, not less. Teams with full visibility into AI use are significantly more worried about data leakage than those without visibility.

• Overworked teams paradoxically embrace AI most optimistically. Nearly three-quarters of IT and security teams spend at least a quarter of their week on repetitive, low-value work. The most overloaded teams are most confident AI will solve their problems.

Background

Heimdal, a global cybersecurity provider, surveyed 1,000 IT professionals split evenly between the UK and US during May 2026. Respondents ranged across six seniority levels from entry-level to C-suite. The research reveals a troubling disconnect between how secure organizational leadership believes they are and the reality facing the teams actually managing AI systems day-to-day.

The timing is significant. Just months before this survey, in January 2026, the acting director of CISA uploaded documents marked "For Official Use Only" to public ChatGPT. The agency's monitoring detected it within a week, but existing policies had failed to prevent the breach entirely.

The Leadership-Frontline Gap

The most striking finding is how dramatically perspectives shift based on proximity to actual AI operations. US executives expressing confidence that AI risk is under control outnumber frontline practitioners by more than four to one. The disparity holds across both countries but appears more extreme in the US market.

This gap is not marginal or within statistical noise. Both the US and UK differences are statistically significant, meaning they reflect real differences in how different levels of the organization perceive the security landscape. Executives are making decisions and setting strategy based on confidence that the people closest to the work do not share.

Adoption Outpacing Controls

Organizations have moved AI implementation forward at breakneck speed. The tools are already everywhere. But security controls have not kept pace. Across both markets, adoption has outrun the ability to secure and manage AI by roughly two to one.

Only about four in ten teams believe their security stack is adequately prepared for AI-specific threats. This readiness gap matters because these organizations are not just dealing with legacy systems anymore. They are trying to secure new, unfamiliar attack surfaces while operating with security infrastructure designed for a different era.

Visibility as Diagnosis, Not Cure

A counterintuitive pattern emerged from the data. Teams with better visibility into how AI is being used are more concerned about data leakage, not less. Among UK teams with full visibility, 56% flag data leakage as a top concern. Among teams with no visibility, only 27% list it as a top concern. The US figures are even starker: 59% with full visibility versus an implied lower percentage without.

This suggests that seeing the problem clearly does increase worry, but it also means blind spots are dangerous. Teams without visibility into their AI usage are not actually safer; they simply do not know what they are missing. Rafay Baloch, CEO of REDSECLABS, pointed out that the real risk comes not from AI itself but from blind spots that allow sensitive data to leak into unintended locations.

The Burnout Paradox

Nearly three-quarters of IT and security professionals lose at least a quarter of their work week to repetitive, low-value tasks. About one in three lose more than half their time to this kind of work. Yet the teams most crushed by operational overload are the most optimistic about AI solving their problems. Fifty-nine percent of the most overloaded US teams expect AI to lighten their load, as do 55% in the UK.

This creates a potential blind spot. Teams desperate for relief may embrace AI solutions without the scrutiny those solutions warrant. Exhausted teams are also less likely to catch problems or maintain proper oversight.

What Organizations Should Do

According to Heimdal's recommendations, the answer is not to restrict AI or create policies that sound good in boardrooms but do not work in practice. Instead, organizations should treat AI as part of their core IT infrastructure and apply the same vendor management practices they use for critical suppliers.

This means procurement reviews for AI tools, careful contractual terms around data handling, maintaining an inventory of both sanctioned and unsanctioned AI applications, and implementing technical controls over access, execution, action chains, and privilege levels. The goal is not to eliminate AI but to create clear guardrails while allowing responsible use.

Sources

• https://securityonline.info/heimdal-survey-executives-four-times-more-confident-about-ai-risk-than-the-teams-managing-it/

• https://hackread.com/heimdal-survey-executives-four-times-more-confident-about-ai-risk-than-the-teams-managing-it/

• https://www.einpresswire.com/article/919916015/heimdal-survey-us-executives-are-four-times-more-confident-about-ai-risk-than-the-teams-managing-it