____________________________________________________________________________________________________________________ AI
exchanges, and AI tools sitting on top of it.
The energy sector’ s advantage is genuine, but it is a head start on the underlying discipline, not a finished build of the specific controls, purpose binding, and AI specific
audit trails among them, that this year’ s
survey measures directly.
None of this means the work is done. A DSCRI of 19.6 is well above the survey mean
of 16.2, yet still a long way short of the top of the scale. IBM’ s Cost of a Data Breach
Report 2026 puts the average industrial
sector breach at five and a half million dollars,
a reminder that a vendor-facing or thirdparty breach in a sector this dependent on
external relationships is exactly the profile
that figure describes.
Where leaders should look next
If your organization already runs a mature operational technology security program, this year’ s data suggests you have more of a headstart on AI governance than you might
assume. The underlying habit of default
restricted access and consistent logging is largely the same skill. The mistake would be assuming that head start closes the gap on its own. Extend the same rigor explicitly to AI
systems, covering purpose binding, AI specific audit trails, and technically enforced access boundaries, rather than assuming operational technology culture covers it by implication.
The energy sector leading this year’ s data did not get there by building something new. It got there by refusing to let a wellestablished discipline stop at the edge of the plant. ■
Frank Balonis www. kiteworks. com
As Field CTO at Kiteworks, Frank Balonis works with security and compliance leaders across regulated industries on data governance architecture. Having previously worked in both system integrator and service provider environments, Frank’ s extensive experience spans a wide range of technologies and applications.
newenergy-today. com 25