Nearly every enterprise believes it has sensitive data protection under control, but new research from Perforce suggests confidence is masking a different reality.
The company’s third annual State of Data Compliance and Security Report, based on a global survey of more than 500 enterprise leaders, found that 98% of organisations are confident in their ability to protect sensitive data. Yet more than a third (34%) have already experienced a data breach or data theft, while 43% report having failed a compliance audit.
The findings point to a growing disconnect between security policies on paper and how consistently they are applied in practice.
Although 99% of respondents say their organisation has data masking policies in place, 84% admit they allow exceptions to those rules, potentially leaving sensitive information exposed in development, testing and analytics environments.
“The research highlights a contradiction between confidence and execution,” said Ross Millenacker, Senior Product Manager for Perforce Delphix and one of the report’s authors. “As organisations expand their use of AI and agentic development, protecting sensitive data at scale becomes significantly more challenging without the right controls in place.”
The report suggests those challenges are becoming more pressing as enterprises accelerate AI adoption.
While 86% of organisations have introduced AI data privacy policies and 98% express confidence in protecting sensitive information used in AI workflows, concerns remain widespread. More than two-thirds (68%) worry about data leakage in AI environments, while 62% are concerned about training data breaches.
Those concerns appear to be translating into investment. Four out of five organisations (80%) plan to increase spending on technologies that protect sensitive data used to train and fine-tune AI and machine learning models over the next two years.
Perhaps more revealing is what organisations see as the biggest obstacle. Rather than regulation or budget, respondents identified data quality as the primary barrier to protecting sensitive information across AI, machine learning and analytics projects, with 51% citing it as their biggest challenge.
The report also highlights the growing importance of modern analytics platforms such as Databricksand Snowflake, which enterprises increasingly view as priority environments for data masking as AI initiatives become more data intensive.
The findings form part of Perforce Delphix’s broader research into enterprise data management and AI readiness. The full 2026 State of Data Compliance and Security Report is available online. Additional reports exploring AI data privacy and synthetic data are expected later this year.