The AI Governance Illusion: 97% of Teams Think They're Covered — and Aren't
Enterprise Developer PlatformsNinety-seven percent of organizations claim certified AI model governance. In the same period that statistic was collected, JFrog Security Research identified 495 malicious models on Hugging Face — a registry that nearly one in five surveyed organizations actively uses. The gap between those two facts is the actual security posture of most enterprise AI programs.
The Confidence Measurement Problem
JFrog’s 2026 Software Supply Chain Report calls this pattern “the illusion of mastery” — organizations that have established governance policies and conflate policy existence with enforcement. The data makes the distinction concrete.
Fifty-nine percent of respondents report full production provenance visibility, meaning they believe they can trace every artifact in their pipeline back to its origin. Yet 48% of the same population requires a week or longer to generate compliance proof per application when asked to demonstrate that visibility. These numbers cannot both be accurate; one reflects a self-assessment and the other reflects operational reality.
Secrets detection is the starker data point: only 28% of organizations have it active, the lowest adoption rate of any named security category in the report. In the same period, JFrog found 17,637 exposed tokens in public binary repositories, of which 3,260 remained active at time of discovery.
The New Attack Surface
The threat landscape has shifted in ways that legacy tooling was not built to address, and the report isolates three structural drivers:
Malicious package volume grew at a rate that flat detection coverage cannot absorb. In 2025, JFrog detected 171,592 malicious npm packages — a 451% increase from 2024. Malicious package detection capability sits at 40% of organizations, unchanged year over year.
The source ecosystem has diversified beyond the Java/package-registry model that most security tooling was designed for. Hugging Face now hosts over 1.4 million new packages annually. Neither the tools nor the processes have adapted to this scale.
The IDE and agent layer is now an active infection vector. Only 57% of organizations govern MCP server usage through automated controls; 18% have no IDE governance at all. Forty-five percent of DevSecOps teams cite reviewing AI-generated code as a top time burden — which means the most human-intensive part of the pipeline is also the most exposed.
Where the CVE Model Breaks Down
The report’s finding on CVE severity is among the more operationally useful: 96% of vulnerabilities rated Critical by the National Vulnerability Database (NVD) were downgraded by JFrog’s environmental context analysis, up from 88% the prior year. The practical implication is that teams triaging based on NVD scores are prioritizing the wrong vulnerabilities at an accelerating rate. Context-aware scoring — accounting for reachability, actual exploit conditions, and runtime environment — changes the remediation queue almost entirely.
The So What
The governance gap JFrog identifies is not primarily a tooling problem. It is a coverage model problem: policies and dashboards that measure intention rather than enforcement. For enterprise platform teams, the operational shift needed is governance that operates continuously in the pipeline — at every ingestion and egress point — rather than existing as a documented policy with periodic audit checkpoints. The 96% CVE downgrade rate alone suggests that most teams are spending significant security budget on noise. Recalibrating toward pipeline-embedded, context-aware controls is where the leverage is.
Photo by Muhammed Ensar on Pexels
Source: JFrog
Content created with AI assistance and reviewed for accuracy.
Join the conversation
Stack Insiders is our free community for readers who want to go deeper — share resources, ask questions, and connect with others across every vertical we cover.
Join Stack Insiders →