A survey of 500 U.S. CISOs published by Vorlon ahead of RSAC 2026 found that 99.4% of organizations experienced at least one SaaS or AI ecosystem security incident in 2025. Only three out of 500 reported zero incidents.

The numbers get more uncomfortable from there. One in three enterprises dealt with a security incident involving AI agents. Nearly 31% experienced unauthorized data exfiltration through SaaS-to-AI integrations. And 27.4% were breached through compromised OAuth tokens or API keys, despite 89.2% of those same CISOs claiming strong OAuth governance.

That disconnect between confidence and outcomes runs through the entire report. Organizations deploy an average of 13 dedicated security tools across their SaaS and AI environments. Roughly 77% say they have full behavioral monitoring in place. Yet 83% to 87% of respondents report limitations across every security capability measured.

The AI Agent Blind Spot

CISOs report 80-85% confidence in understanding what data major AI tools like ChatGPT, Claude, Copilot, and Gemini can access. That confidence drops to 65.4% for other AI tools, with a quarter of respondents reporting no confidence at all. Meanwhile, 75.4% characterize AI agents as a critical or significant data security risk.

“The security architecture most organizations have was built for the front door: application configurations, user logins, permission settings,” said Amir Khayat, co-founder and CEO of Vorlon. “The threat has moved to the engine room, the runtime layer where AI agents move sensitive data between systems, where OAuth tokens grant persistent cross-platform access, where a single compromised integration cascades silently across an entire SaaS supply chain.”

Supply chain risk weighs heavy: 99% of CISOs expressed concern about a SaaS or AI supply chain breach in 2026, following incidents like the Salesforce ShinyHunters vishing attack and the Gainsight supply chain compromise. Yet only 0.8%, four out of 500, feel adequately protected.

The spending response is clear. 86.8% plan to increase SaaS security budgets in 2026, and 84.2% plan to increase AI security budgets.