New research from Red Hat reveals a gap between confidence in AI security and actual visibility into the software supply chain at Belgian companies. Although many CIOs feel secure, they often lack control over data flows and components.
The adoption of autonomous AI agents is moving at breakneck speed in Belgium. At 99 percent of the companies surveyed, these agents are already running in the production environment. Yet decision-makers often have less grip on the underlying technology than they think.
Red Hat’s survey of 100 Belgian CIOs shows that 80 percent of respondents are confident in the security of their AI agents. They assume that regulatory compliance and monitoring are sufficient to manage risks.
Lack of visibility into the software supply chain
That optimism does not translate into practice. Only 68 percent of Belgian CIOs say they know exactly how data flows within the organisation and where it is stored or processed. A considerable group therefore has not fully mapped where business-critical information is located.
The situation around the software supply chain is even more worrying. Only 23 percent of the CIOs surveyed have a complete overview of their own software supply chain, including the origin and versions of open source components. This lack of insight into direct and indirect dependencies is a potential security risk.
Risks with AI providers
Stef Schampaert, country managing director Belgium & Luxembourg at Red Hat, stresses that effective AI governance requires full visibility. According to him, companies need to know which software components they use and which risks providers bring with them throughout the entire lifecycle of an AI agent.
Oversight of external parties is also limited at present. Barely 28 percent of Belgian CIOs assess the risks of AI providers continuously, even after the initial onboarding is completed. Most companies limit themselves to a one-off assessment before the technology is deployed. Companies that want to scale up AI will therefore have to invest in better monitoring and governance mechanisms to detect vulnerabilities in time.