Putting AI Security into Action: Key Takeaways from the SANS Govern Field Guide

AI adoption is outpacing the oversight required to safeguard it. The SANS | GIAC 2026 Cybersecurity Workforce Research Report (947 respondents) found that only one organization in five has a comprehensive AI governance framework, and 24% have no plans at all. In UpGuard's State of Shadow AI survey, 81% of employees reported using unapproved AI tools.

A targeted focus on AI governance is non-negotiable today. The Govern track of the SANS AI Security Maturity Model™ eBook treats governance as the base of any AI security program, and its scoring makes that literal. The model rates each of its three tracks (Govern, Protect, and Utilize) across five stages of maturity, from Stage 1 (Unaware / Ad-Hoc) to Stage 5, based on documented evidence. Overall maturity cannot rise more than one stage above your Govern score, so Stage 2 governance caps a program at Stage 3 however sharp its detection is.

Govern First, a new field guide authored by Chris Cochran, SANS Field CISO and VP of AI Security, is written for the security leader who already has a governance policy on the books but needs to scale it. The field guide covers five governance capabilities (policy, risk management, oversight and accountability, shadow AI and BYOAI visibility, and compliance readiness) and the moves that carry a program from Stage 2 to Stage 3. Below are the key takeaways from the guide worth considering, followed by several areas worth adding as AI systems move into production.

Key Takeaways to Consider

• Replace the ban with a policy that enables. The guide calls the blanket "do not use AI" rule the Framework of No. A ban leaves employees with no way to make a good decision, so usage moves to personal accounts and unmanaged devices. A working policy classifies tools by data sensitivity and use case, so an employee knows what is fine for a public marketing draft and what is off-limits for regulated customer data. Role-based AI literacy training equips each role to follow it.
• Show evidence. Capabilities are scored from 0 to 5 on evidence, and self-reported capability with nothing behind it caps at 2. A policy no one approved, or a process that exists only in someone's memory, does not clear the bar. The guide's lottery test asks what happens when the one engineer who knows your AI onboarding process takes a new job. A Stage 3 capability survives that loss because it lives in documentation others can pick up and run.
• Give every agent an owner and a halt authority. The guide describes an agent running on undocumented credentials as an orphan with permissions, and it warns that an orphaned agent can turn a one-hour investigation into a week-long one. Each deployed agent needs a documented human owner and a named person with authority to halt it at 2 a.m., following a documented procedure. At Stage 3, trace IDs across every agent step and tool call let you reconstruct an incident in minutes instead of days.
• Make visibility continuous. Without monitoring, a policy is only a suggestion. At Stage 2, discovery is usually a one-time survey that is stale within a quarter. The move to Stage 3 is continuous application-level monitoring and logging, and it should answer on demand which AI tools are in use, who is using them, and what data is reaching them. Start by confirming you could produce 90 days of usage evidence for each of your three most-used AI tools.
• Scale it to your size. None of this requires enterprise scale. At a 30-person company, the governance council can be as simple as one named person with a real mandate and 90 minutes a week. A four-column spreadsheet covering tool, data access, owner, and approved can stand in for an integrated GRC platform. A one-page policy, a team briefing, and a reassessment in 90 days can stand in for board-level reporting, and the formal cadence can follow as the program matures.

Other AI Trends to Watch

• Change management for non-deterministic systems. Traditional change management assumes you know what a change will do. AI is non-deterministic, so even a small change can have a dramatic effect. Take a retrieval-augmented generation (RAG) application. One document added to its vector database can contradict existing information, leave gaps, trigger hallucinations, or hand an adversary an opening. Require two or three levels of approval before ingestion and test in a sandbox, despite the friction. Most organizations I work with treat AI changes like traditional ones.
• Data governance for AI. Every AI system rests on its data, so I would go deeper here than the guide does. Classification defines what is permitted in these systems and what is not. Provenance tracks where data originates and how it gets used. Retention rules and source validation complete the picture, especially before anything is ingested into an application like that RAG example. Your data sources make or break what AI can do for you on security, bias, and hallucination.
• MLSecOps. DevSecOps built CI/CD pipelines that let developers, security, and operations work in the same sandbox. MLSecOps (Machine Learning Security Operations) extends that work to the data scientists who develop models and handle data. It adds two things to the DevSecOps model, model security and data governance and security. The people shaping a model and the data behind it now join the teams that already share a pipeline, and the controls need to follow them.
• Metrics that govern. Track the percentage of AI systems with documented owners, the shadow AI instances you find, audit and logging coverage, and time to detect, respond, and contain. Organizations measure human access well and non-human identities poorly, so add credential rotation for service accounts and API keys. AI security posture management (AI-SPM) tools, the counterpart of cloud security posture management, look for shadow AI and check systems against your controls. Write the controls first, then configure the tool.
• Kill switches and human control. The guide pairs a halt authority with a kill switch for agents. Where AI touches human safety, in hospitals, aircraft, and cars, the question gets sharper. Human-in-the-Loop (HITL), Human-on-the-Loop (HOTL), and Human-in-Command (HIC) each describe how much control a person keeps, and each needs a real circuit breaker behind it. If the AI puts someone in harm's way, a person must be able to shut it off right away.

Download the SANS Govern First Field Guide Today

Governance sets the ceiling for the rest of your AI security program, and the first moves are within reach of any team. Name an owner, replace the ban with a policy that enables, and put the first review on the calendar. As the program matures, the areas above (change management, data governance, and metrics) are where to build next.

Govern First walks through the five capabilities and the five moves from Stage 2 to Stage 3, with a link to the self-assessment so you can determine your Govern score and what gaps to address first.

Download the SANS Govern Field Guide here.