The SANS AI Security Maturity Model, Explained
What is the SANS AI Security Maturity Model?
The SANS AI Security Maturity Model is a 2026 framework that scores an organization's AI security across three pillars and five stages, based on what it can prove rather than what it has written down. It was authored by SANS Field CISO Chris Cochran.
Most organizations we speak to have an AI policy. Very few can prove anyone follows it.
That gap now has a score. And by the model's own rules, most organizations sit a stage lower than they think.
TL;DR
- The model scores Protect, Utilize, and Govern across five stages, from Unaware to Optimizing.
- Two rules keep it honest: overall maturity can't sit more than one stage above Govern, and anything without documented evidence is capped at Stage 2.
- Most organizations land at Stage 1–2. Crossing to Stage 3 takes automated discovery, AI-specific classification, AI-aware controls, and a cross-functional governance body.
Why does AI security maturity matter now?
Because AI adoption has outrun AI governance in almost every organization. The numbers make the gap hard to argue with.
- AI use tripled in a year. According to the 2026 Verizon DBIR, 45% of employees now regularly use AI on corporate devices, up from 15% the year before. 67% of them use personal accounts.
- Shadow AI is now a top insider issue. It was the third most common non-malicious insider action in the DBIR, up 4x year over year.
- Sensitive data is going in. Across 858,000+ DLP events targeting GenAI apps, source code was the most common data type at 28%, followed by documents and PDFs (23% combined) and structured data (14%).
- The connections pile up. The average organization has 16 AI apps, 17 AI browser extensions and 17 AI OAuth integrations in active use, most of them unapproved.
- Attackers use AI too. Anthropic identified 793 threat actors using AI for malicious cyber activity between March 2025 and February 2026.
Look at the fourth number again. Seventeen AI OAuth integrations, most never approved. Each one is a vendor holding a key to your data that never went through procurement.
What are the three pillars of the SANS AI Security Maturity Model?
The model scores AI security across three pillars. Each is assessed separately, which stops strength in one area from hiding weakness in another.
- Protect: defending the organization against AI-enabled threats.
- Utilize: using AI inside your own security operations.
- Govern: policy, discovery, access and risk management for AI across the business.
What are the five stages of AI security maturity?
Each pillar moves through five stages, from no visibility at all to self-improving defenses.
- Stage 1 – Unaware/Ad Hoc: no inventory exists, and leadership may not know how much AI is in use.
- Stage 2 – Reactive/Policy-Emerging: a coarse policy exists, and known AI tools may be blocked.
- Stage 3 – Defined/Risk-Informed: AI is governed through enterprise tools, and governance can be demonstrated to regulators and partners.
- Stage 4 – Managed/Integrated: AI risk is quantified, not estimated.
- Stage 5 – Optimizing/Adaptive: defenses improve themselves. This is mostly found at large tech and AI-native firms.
How does SANS score AI security maturity?
Two scoring rules make the model honest. First, your overall maturity can't rise more than one stage above your Govern score. Second, any capability claimed without documented evidence is capped at Stage 2.
The first rule means a sharp AI-powered SOC can't paper over weak governance. The second means a policy PDF, a slide in the board deck, or a vendor's promise counts for nothing on its own.
The model doesn't care what you've written down. It cares what you can prove.
Why are most organizations stuck at Stage 2?
Because Stage 2 is where policy lives, and policy alone can't be proven. Most security leaders we speak to land between Stage 1 and Stage 2. They know there's a problem. They've written a policy. Maybe they've blocked ChatGPT.
SANS calls this the "Framework of No." Block-based policies feel like risk management. In practice, they drive AI use underground instead of stopping it.
That's the chasm. On one side sit awareness and policy. On the other sits real capability: seeing what's happening and acting on it.
SANS spells out what crossing requires: automated discovery (not a survey), AI-specific data classification, AI-aware controls and a cross-functional governance body.
That last one matters more than it looks. This isn't just an IT or security problem. Sales connects meeting assistants, Finance connects slide builders and HR connects CV screeners. Every department head is now onboarding AI vendors.
What happens when an AI tool gets breached? The Vercel case
In April, Vercel was breached through a small AI tool.
It appears a Vercel employee signed up for Context.ai with their enterprise account and granted "Allow All" permissions. When Context.ai was compromised, the attacker took over the employee's Google Workspace account and accessed some Vercel environments and environment variables.
Customer credentials were compromised. The tool's wider compromise could affect hundreds of users across many organizations.
One small AI vendor. One click. Hundreds of potential victims.
Many AI vendors are small teams shipping fast, with security still catching up. Yet they ask for your email, files, and calendars. It's the same third-party pattern we track in our third-party breach tracker: hackers don't hack in; they log in through someone you trusted.
Vercel also shows why SANS weighs Protect alongside Govern. A governance program can document a risk perfectly and still fail to stop the attack. A policy doesn't flag a stolen token being used. Watching behavior does.
How does the SANS model map to compliance frameworks?
The model maps to the NIST AI RMF, the EU AI Act, ISO 42001, and OWASP. Stage 3 is defined by demonstrating governance to regulators and partners, so compliance is built into the climb.
Regulators want proof that personal data isn't flowing to unassessed vendors. In the GCC, UAE PDPL makes that a data protection question. Auditors want evidence, not policy PDFs. Customers are adding AI questions to security questionnaires.
After Vercel, affected customers had compliance questions of their own. One employee's click became someone else's audit finding.
How do you move from Stage 2 to Stage 3?
You move from Stage 2 to Stage 3 by replacing policy with evidence. Five steps get you there.
- Build the inventory automatically. Employees won't self-report tools they're unsure they're allowed to use. Start from the OAuth grants in your Google and Microsoft environments.
- Classify what you find. An AI notetaker on the CEO's inbox is not the same risk as a grammar checker.
- Revoke the risky and the forgotten. Remove "Allow All" scopes, unused grants and anything tied to leavers.
- Watch behavior, not just access. Stolen tokens get used. Catch the use.
- Assess against evidence, not aspiration. Score yourself on what you can show today.
Where FrontierZero fits
FrontierZero makes steps one to four continuous. You get a live inventory of every AI and SaaS app connected to your environment: who connected it, when, and what it can reach.
Pattern-of-life monitoring flags when an app or account starts behaving out of character. It's the same approach we apply to compromised identities in Slack and Teams. Together, that's the evidence that lifts you past the Stage 2 cap.
To be clear about scope: we don't secure AI models or stop prompt injection. But you can't govern AI you can't see.
FAQ
Who created the SANS AI Security Maturity Model?
It was written by Chris Cochran, Field CISO at SANS. It scores organizations across three pillars (Protect, Utilize and Govern) and five maturity stages.
What is the Stage 2 cap?
The Stage 2 cap is a scoring rule: any capability claimed without documented evidence can't be scored above Stage 2. A written policy with no proof of enforcement stays at Stage 2.
What is the Governance Floor Rule?
Your overall AI security maturity can't sit more than one stage above your Govern pillar score. Strong AI-powered defenses can't compensate for weak governance.
What is the "Framework of No"?
It's SANS's term for block-based AI policies. They feel like risk management but tend to push AI use underground, which creates more shadow AI rather than less.
What does Stage 3 AI security maturity require?
Stage 3 requires governing AI through enterprise tools and being able to demonstrate that governance to regulators and partners. In practice, that means automated discovery, AI-specific data classification, AI-aware controls and a cross-functional governance body.
Which frameworks does the SANS model map to?
It maps to the NIST AI RMF, the EU AI Act, ISO 42001 and OWASP.
See what's already connected
Our free Shadow AI Report finds the SaaS and AI connections in your environment: what's connected, who connected it, and what it can reach.
Then score yourself against SANS again. We suspect the number will change.