Security is 18 months ahead of AI governance, and that gap is structural

The security community is 18 months ahead of the governance community on AI risk. That gap is not a lag, it is a structural misalignment. Security writes about actively exploited vulnerabilities and supply chain attacks. Governance writes about privacy and fairness. Attackers have already moved to agentic and memory-based attacks, and governance is still catching up to yesterday's threats.

What most people think

Most people believe governance and security are complementary disciplines that will converge as regulations mature. The argument goes like this: security handles the technical details, governance handles the policy and compliance, and once the EU AI Act and other rules land, the two will merge into one coherent practice. The timelines will align, the risk registers will match, and everyone will be defending the same attack surface.

That view is comfortable but wrong. It assumes the gap is a timing issue that regulation will fix. It is not a timing issue. It is a difference in what each community treats as the problem.

What the data shows

Our live incident database, which tracks reported AI failures from public news, shows 821 stories in the last 180 days. In the last 45 days, 362 stories. The 45 days before that, 459. The volume is not the story. The categories are.

In the last 45 days, governance stories dropped from 220 to 143. Security stories dropped from 52 to 35. Privacy stories dropped from 56 to 44. Fairness dropped from 51 to 34. But compliance stories rose from 45 to 76. That is a 69 percent increase in compliance coverage while security coverage fell by a third.

The news window barely reports the risks that matter most. Overreliance and unsafe use: zero stories in 180 days. Environmental harm: zero. Lack of capability or robustness: zero. Meanwhile, privacy leaks got 81 stories, fraud got 61, and AI system security vulnerabilities got 59.

Now look at what the security side is writing about. Our sister platform ThreatClaw, which tracks the threat side, published 40 articles in 60 days. The recurring tags are Actively Exploited (9), Supply Chain Attack (8), and Prompt Injection (6). Recent titles include "Attackers Can Quietly Rewrite an AI's Memory" and "Your 'Deleted' Data Still Lives Inside Your AI."

MITRE ATLAS documents real-world case studies for attack techniques. LLM Prompt Crafting has 22 documented cases. Evade AI Model has 18. AI Agent Tool Invocation has 15. User Harm has 12. Financial Harm has 11. None of these appear in the governance news window.

Why this happens

Security researchers publish what is being exploited today. They track live feeds, they analyze malware, they document attack chains. Their time horizon is hours and days. Governance teams publish what regulators are about to demand. Their time horizon is months and years.

The EU AI Act's serious-incident reporting requirement under Article 73 does not apply until December 2027. That is 18 months away from today. The high-risk obligations under Annex III also apply from December 2027. The embedded high-risk rules under Annex I do not apply until August 2028.

Colorado's original AI law was repealed and replaced by a narrower one starting January 2027. Canada has no comprehensive federal AI law right now. The regulatory deadlines are all in the future, and they are all clustered in 2027 and 2028.

So governance teams are writing about what compliance will look like in two years. Security teams are writing about what attackers did last week. The two communities are not converging. They are orbiting different planets.

The best argument against this

The strongest objection is that governance and security are solving different problems, and that is fine. Governance is about accountability, transparency, and fairness. Security is about defending systems. A bank needs both a compliance officer and a penetration tester, and they do not need to read the same reports.

That argument has some force. Governance is not a subset of security, and security is not a subset of governance. But the objection fails when the attack surface moves faster than the regulatory calendar.

A governance team that builds a compliance program around privacy and fairness, while ignoring agent tool invocation and memory manipulation, will produce a program that does not address the actual attack surface. The regulator will be satisfied. The attacker will not care.

What I think happens next

By January 2027, at least one major AI governance framework will add "memory manipulation" or "agent tool invocation" as a named risk category, directly borrowing from security research. The security community has already documented these techniques with real case studies. The governance community will catch up, but it will catch up late.

What would prove me wrong: if governance frameworks continue to ignore these attack vectors through 2027, then the structural gap claim is overstated, and the two communities really are converging on their own terms.

What to do about it

Start this week. Do not wait for the regulations.

• Create a joint governance-security working group that reviews threat intelligence monthly. Use a feed like ThreatClaw's, or your own internal threat intel. The point is to make security findings a standing input to governance decisions.

• Map your AI risk register to MITRE ATLAS techniques, not just regulatory categories. If your register has no entry for prompt injection or agent tool invocation, it is incomplete. Add those rows now.

• Read the security literature alongside the regulatory literature. A good start is the ThreatClaw piece on connecting AI rules to real-world attacks, at www.threatclaw.ai/blog/when-frameworks-collide-mapping-ai-governance-to-your-kill-chain. It shows how to bridge the two worlds.

• Review your incident response plan for AI-specific attacks. If your plan does not cover a prompt injection that exfiltrates data through a tool call, write that scenario in.

• Track the gap. Once a quarter, compare the top categories in your threat intel feed against the top categories in your governance news feed. If they do not overlap, you are defending yesterday's threats. A governance or risk program can help you institutionalize that review, but the review itself is the point.

The regulations will arrive in 2027 and 2028. The attackers are already here. Build the bridge before the deadline does it for you.

More from our platforms

These sister platforms cover the parts of this problem that sit outside governance.

• Argus (argus.threatclaw.ai) records every trace an AI application produces and scans it for prompt injection, jailbreaks and data leaks, including the attacks hidden inside retrieved documents and tool results rather than in what the user typed. Governance decides what an AI agent is allowed to do. Argus shows what it actually did.
• ThreatClaw (www.threatclaw.ai) tracks the threat side of the same systems: 22 live intelligence feeds, exploitation predicted before it is officially confirmed, threat actor profiles, and detection rules you can deploy straight away. A control is only as good as the threat it is sized against.
• Xodexa (xodexa.com) runs 300 AI agents through structured, multi-round debates on the questions that do not have settled answers, and publishes the verdicts and the predictions that come out of them. Useful when the governance question is genuinely contested and you want the strongest version of the other side.

Related reading:

• Hackers Stopped Studying Your Code — They're Reading Your Cloud Receipt on ThreatClaw
• How to Connect AI Rules and Regulations to Real-World Attacks on ThreatClaw