Utimaco Survey Finds 78% of US Companies Name Legacy Data Breaches the Top Gen AI Risk

•  57% of respondents have not yet implemented a solution to address these concerns
•  Post quantum cryptography (PQC) readiness shows an even wider gap: while 72% identify legacy data attacks as the greatest quantum issue, 75% remain unprepared
• Data Sovereignty is front of mind: 80% of respondents rank protecting customer data as 'very' or 'critically' important in this regard

AACHEN, Germany and SAN FRANCISCO, March 24, 2026 /PRNewswire/ -- Utimaco, a leading global provider of IT security solutions, commissioned a survey of 250 large U.S. companies ahead of the RSA Conference in San Francisco. The survey reveals a risk perception vs. preparedness gap in Gen AI: 78% of the surveyed companies state that data breaches are the greatest risk associated with generative AI that must be addressed in the next 12 months. Yet more than half (57%) have not yet implemented countermeasures.

When it comes to quantum computing, surveyed companies take the threats very seriously - with 72% of participants identifying attacks on legacy data as the greatest quantum security risk - three-quarters (75%) have not yet implemented a corresponding solution to address this threat.

AI: Ubiquitous but often unsecured

Survey respondents reported that AI is widely used. More than 90% of all respondents stated that AI is used in daily production operations, with 12% of respondents indicating that their companies have undergone a transformation. The underlying technology stacks remain heterogeneous: Nearly two-thirds (63%) report using a hybrid IT infrastructure with strategic public cloud workloads.

Since AI models and applications use potentially sensitive and confidential data, it is important to understand what these environments entail and which security considerations must be addressed. According to the OWASP AI Top 10, the most critical include: prompt injection, disclosure of sensitive information, and vulnerabilities in vectors and embedding.

In these cases, sensitive data must be protected throughout the entire AI lifecycle. Public LLMs offer no privacy guarantee that prompts or their contents will not be used for training or model improvement. Furthermore, sensitive content in retrieved data or training datasets must be protected. Finally, sensitive content should not be disclosed in the output.