Utimaco Survey Finds 78% of US Companies Name Legacy Data Breaches the Top Gen AI Risk

•  57% of respondents have not yet implemented a solution to address these concerns
•  Post quantum cryptography (PQC) readiness shows an even wider gap: while 72% identify legacy data attacks as the greatest quantum issue, 75% remain unprepared
• Data Sovereignty is front of mind: 80% of respondents rank protecting customer data as 'very' or 'critically' important in this regard

AACHEN, Germany and SAN FRANCISCO, March 24, 2026 /PRNewswire/ -- Utimaco, a leading global provider of IT security solutions, commissioned a survey of 250 large U.S. companies ahead of the RSA Conference in San Francisco. The survey reveals a risk perception vs. preparedness gap in Gen AI: 78% of the surveyed companies state that data breaches are the greatest risk associated with generative AI that must be addressed in the next 12 months. Yet more than half (57%) have not yet implemented countermeasures.

When it comes to quantum computing, surveyed companies take the threats very seriously - with 72% of participants identifying attacks on legacy data as the greatest quantum security risk - three-quarters (75%) have not yet implemented a corresponding solution to address this threat.

AI: Ubiquitous but often unsecured

Survey respondents reported that AI is widely used. More than 90% of all respondents stated that AI is used in daily production operations, with 12% of respondents indicating that their companies have undergone a transformation. The underlying technology stacks remain heterogeneous: Nearly two-thirds (63%) report using a hybrid IT infrastructure with strategic public cloud workloads.

Since AI models and applications use potentially sensitive and confidential data, it is important to understand what these environments entail and which security considerations must be addressed. According to the OWASP AI Top 10, the most critical include: prompt injection, disclosure of sensitive information, and vulnerabilities in vectors and embedding.

In these cases, sensitive data must be protected throughout the entire AI lifecycle. Public LLMs offer no privacy guarantee that prompts or their contents will not be used for training or model improvement. Furthermore, sensitive content in retrieved data or training datasets must be protected. Finally, sensitive content should not be disclosed in the output.

Not surprisingly, according to respondents, data breaches and intellectual property theft are the two biggest security risks in the field of Gen AI. In the survey, 78% stated that data breaches are the biggest problem, followed by 77% who are concerned about intellectual property theft.

The quantum security gap

The vulnerability of currently existing data is cited as the most significant problem related to threats posed by quantum computers; 75% stated that attacks based on the "Harvest Now, Decrypt Later" (HNDL) principle must be addressed most urgently. Today, the collection of currently encrypted data is not even necessarily considered a data breach. Most web and internet traffic is traditionally encrypted using algorithms such as RSA. However, RSA is vulnerable to quantum attacks. Networks on the internet have peering and mirroring agreements, and intercepting encrypted traffic is trivial and practically undetectable. Despite concerns about HNDL, companies are lagging behind in implementing countermeasures: Only 23% have implemented a solution.

Action is needed here, and companies should become crypto-agile as soon as possible. Crypto-agility refers to the flexibility to add, modify, or disable PQC algorithms so that data remains protected against quantum threats. This flexibility is particularly important for maintaining compatibility with existing infrastructure.

Data sovereignty prioritised in distributed AI landscapes

As models become more powerful, the AI lifecycle becomes more distributed, with local, edge, cloud, and private data center venues growing in importance. Protecting data at all these execution venues throughout the lifecycle requires scalable cryptography and data security. With this distributed lifecycle, other factors, such as data sovereignty, also become significant. Protecting sensitive customer data emerged as the primary concern relating to data sovereignty, with 80% of respondents deeming it 'very' or 'critically' important. Even though the United States does not have a national privacy law that requires data encryption or operational residency like GDPR in the EU, it is compelling that sovereignty has truly become a global concern.

"Given the new risks posed by technologies such as AI and quantum computing, data protection and data security require strategic measures. Agent-based processes push the boundaries of data, and these require strong cryptography at every step within various data pipelines, models, datasets, and execution environments. Developing a long-term encryption strategy provides the necessary flexibility to address current data protection threats to AI and future risks posed by quantum computing," says Tina Stewart, CMO at Utimaco.

The 2026 Utimaco Digital Trust Report, a commissioned report by 451 Research from S&P Global Energy Horizons, found that four out of five respondents said data privacy breaches were the top Gen AI security risk, but three out of five had not yet deployed or were only in planning phases to deploy solutions to address the risk. Similarly for PQC, three out of four said exposure of legacy data from quantum security risk, while three out of four also had not yet deployed any solution to address the risk.

"The tension between enterprise risk and readiness is real", says Justin Lam, Industry Analyst at 451 Research.

The full "2026 Utimaco Digital Trust Report" is available for download here.

Utimaco will be on-site at RSAC 2026 in San Francisco from March 23 to 26, 2026, at Booth #4428.

About Utimaco

Utimaco is a global platform provider of trusted Cybersecurity and Data Protection solutions and services with headquarters in Aachen (Germany) and Campbell, CA (USA). Utimaco develops on-premises and cloud-based hardware security modules, solutions for key management and data protection as well as Public Warning Systems. Utimaco is one of the world's leading manufacturers in its key market segments.

400+ employees around the globe create innovative solutions and services to protect data, identities, citizens and digital assets with responsibility for global customers and citizens. Customers and partners in many different industries value the reliability and long-term investment security of Utimaco's high-security products and solutions. Find out more on www.utimaco.com.

Media contact

Utimaco
Silke Paulussen
+49 241 1696-150
pr@utimaco.com

Logo - https://mma.prnewswire.com/media/2864429/5877932/utimaco_Logo.jpg