From Framework to Action: Applying the SANS AI Security Maturity Model: Practical Strategies From SANS Experts and Industry Leaders for Assessing, Advancing, and Operationalizing AI Security Maturity

Most security teams are working through the same early questions about AI at the same time. In a poll at the SANS Expert Thought Leadership Forum, 60% of attendees placed their organizations at Stage 2 of the SANS AI Security Maturity Model™, and 55% could not say how their agents are identified.

This report captures what happened when nine industry experts, three executive panelists, and SANS field CISO Chris Cochran put the model to the test on September 16, 2026. Does a maturity score really measure resistance to attack? How should teams govern agents when prompt injection may never be solved? What proof should a board require before trusting an AI-generated finding?

Inside, you will find the poll results, Cochran’s seven ways organizations go wrong, a candid executive debate on the model’s limits, and perspectives spanning governance, application security, offensive testing, and identity, plus practical takeaways you can apply now.

Feeling behind is the norm, and this report shows what to do next. Download it to see where the model holds up, where it invites challenge, and how to move your AI security program forward with intention.