Training
Featured Course View All Courses
Get a Free Hour of SANS Training

Experience SANS training through course previews.

Learn More
Learning Paths
FeaturedView all Focus Areas
NEW - AI Security Training
Can't find what you are looking for?

Let us help.

Contact us
Free Resources

SANS Community Benefits

Connect, learn, and share with other cybersecurity professionals

Customer Case Studies

Discover how organizations and individual cyber practitioners use SANS training and GIAC certifications

AI Risk & Readiness

Explore expert-driven guidance, training, and tools to help defend against AI-powered threats and adopt AI securely

Join the SANS Community

Become a member for instant access to our free resources.

Sign Up
For Organizations

Public Sector

Mission-focused cybersecurity training for government, defense, and education

Partnerships

Explore industry-specific programming and customized training solutions

Sponsorship Opportunities

Sponsor a SANS event or research paper

Interested in developing a training plan to fit your organization’s needs?

We're here to help.

Contact Us
Group Purchasing
Group Purchasing

Governance Is the Ceiling on Your Entire AI Security Program

The AI Govern Field Guide breaks down the five capabilities that move a program from Stage 2 to a defensible Stage 3, each with a specific move you can act on this week.

Get the AI Govern Field Guide
2026 AISMM Govern eBook

Every organization eventually runs into the same instinct when AI starts to feel risky: control it, restrict access, publish a policy that says don't. That instinct is where most programs go wrong. A blanket ban doesn't stop AI use. It pushes it out of sight, onto personal accounts and unmanaged devices, where nobody can govern it at all.

The SANS AI Security Maturity Model™  treats governance as more than one of three equal pillars alongside Protect and Utilize. It's the foundation the other two stand on, and the scoring reflects that directly: your overall AI security maturity cannot rise more than one stage above your Govern score. A program stuck at Stage 2 governance caps at Stage 3 overall, no matter how strong detection is or how much work has gone into protecting models.

The AI Govern Field Guide is the deep dive built to close that gap. It takes the five scored Govern capabilities: policy, risk management, oversight and accountability, shadow AI visibility, and compliance readiness, and gives each one a specific, practical move for reaching Stage 3. Not theory. A "do this Monday" action for every capability.

Get the Field Guide

Haven't Downloaded the Full Framework Yet?

The SANS AI Security Maturity Model™ eBook lays out the complete framework — Protect, Utilize, and Govern — across five maturity stages, with a scored self-assessment to see exactly where your organization stands today. If you haven't downloaded it yet, it's the natural next step: the AI Govern Field Guide tells you how to raise your Govern score, and the eBook shows you what that score means for your program overall, including the same scoring rule that puts a ceiling on maturity in the first place.

Get the AI Security Maturity Model eBook
2026 AISMM Govern eBook

Keep Going

Governance is one piece of a much larger picture. SANS's AI research spans how organizations are adopting AI, where it's already being used against them, what the workforce needs to keep pace, and how to train for all of it.

Explore the latest AI security survey data, webcasts, courses and certifications mapped to every stage of the maturity model, and ongoing research as the field keeps moving, all in one place.

Explore More AI Security Research and Training
Woman Looking at Laptop

Key Takeaways on the AI Govern Field Guide

  • Governance sets a hard ceiling on AI security maturity. Under the SANS AI Security Maturity Model™, overall maturity cannot exceed one stage above the Govern score, regardless of Protect or Utilize performance.
  • The model scores five Govern capabilities: AI Policy, Risk Management, Oversight and Accountability, Shadow AI and BYOAI Visibility, and Compliance Readiness.
  • Evidence determines the score, not intention. Self-reported capability without documentation caps at a score of 2 out of 5, even if the underlying practice is sound.
  • BYOAI and Shadow AI are not the same thing. BYOAI (Bring Your Own AI) is policy-neutral: employees using personal or unapproved tools before any policy exists. Shadow AI only exists once a policy is in place for it to violate.
  • The AI security skills gap (60%) now outranks headcount (40%) as the top workforce challenge in the field, a reversal from prior years.
  • AI Governance, Risk and Compliance Lead roles are hiring now, with reported salaries between $160,000 and $240,000.
  • Program size doesn't determine program quality. A lean team with one named owner and a documented process can score higher than a large enterprise with undocumented practices.
  • Regulatory pressure is accelerating governance requirements, with frameworks including the EU AI Act, NIST AI RMF, ISO 42001, and the OWASP AI Exchange shaping what auditable AI governance now requires.

FAQs

It's a field guide from the SANS AI Security Maturity Model™ eBook that focuses specifically on the Govern pillar, one of three pillars (alongside Protect and Utilize) in the broader AI Security Maturity Model. It was written by Chris Cochran, Field CISO and VP of AI Security at SANS, with a foreword by Rob T. Lee, Chief AI Officer at SANS.

In the SANS AI Security Maturity Model™, an organization's overall maturity score cannot rise more than one stage above its Govern score. This reflects the idea that without a governance foundation, an organization has no reliable baseline for what normal looks like, which makes strong detection or protection capabilities harder to trust or sustain.

The five scored Govern capabilities are: AI Policy That Enables, AI Risk Management, Oversight and Accountability, Shadow AI and BYOAI Visibility, and Compliance Readiness.

BYOAI (Bring Your Own AI) describes employees using personal or unapproved AI tools for work, and it's policy-neutral because it can exist before any governance policy is written. Shadow AI is narrower: it describes AI use that violates a policy that already exists. A policy is what turns BYOAI into a measurable Shadow AI problem.

The Govern Field Guide outlines five specific moves: standing up a cross-functional governance council, replacing a binary AI policy with a tiered, enabling policy framework, adding AI risks to the enterprise risk register, turning one-time AI discovery into continuous usage monitoring, and documenting the AI asset inventory with a named owner and halt authority for every entry.

No. The model is built to scale down. A small organization with one named governance owner, a documented policy, and a regular review cadence can score a genuine, evidence-based Stage 2, which represents a stronger security posture than a large enterprise claiming a higher stage without documentation to support it.

Yes. It's available as a free download after completing a short form.

The Govern Field Guide is a deep dive into one of the three pillars covered in the full AI Security Maturity Model™ eBook (Protect, Utilize, and Govern). The eBook covers all three pillars and includes the full self-assessment; this guide expands specifically on Govern.