91% of Execs Lack AI Dependency Visibility, Creating Massive Cyber Risk: IBM Study

When you can't see your critical supply chain, you can't secure it. That is the hard lesson from IBM’s latest research on AI sovereignty, which finds that almost all enterprises (91%) lack full visibility into their AI dependencies—a blind spot that cybersecurity leaders can no longer ignore. As AI models and platforms become deeply embedded in operations, these opaque dependencies expose organizations to vendor-driven disruptions, unmonitored data flows, and new attack surfaces that legacy third-party risk frameworks were never designed to handle. The study quantifies just how exposed enterprises really are and why the CISO must now own AI dependency risk as a top-tier security concern.

A new global study from the IBM Institute for Business Value, based on a survey of 1,000 senior executives across 16 countries and 17 industries, paints a stark picture of enterprise AI dependencies: 71% of respondents say switching their primary AI vendor or model would be difficult, and 68% struggle to meet data residency and sovereignty requirements across geographies. The research, titled The Calculus of AI Sovereignty, reveals that while AI is becoming more deeply embedded in core business operations, most organizations have ceded control over critical systems in ways that create significant operational, financial, and compliance risks. The findings highlight a growing governance gap that, if left unaddressed, could expose enterprises to costly disruptions and limit their ability to adapt as the AI landscape evolves.

“

That is the hard lesson from IBM’s latest research on AI sovereignty, which finds that almost all enterprises (91%) lack full visibility into their AI dependencies—a blind spot that cybersecurity leaders can no longer ignore.

Why this matters now is simple: AI adoption is no longer limited to experimental projects. Enterprises are using AI to power customer-facing applications, supply chain optimization, and internal decision-making. The dependencies that come with this adoption—on specific large language models, cloud infrastructure, and third-party services—are multiplying faster than most organizations can track. The IBM study quantifies the blind spot: 91% of surveyed executives admit they do not fully understand their organization's dependencies across AI vendors, models, and infrastructure. This lack of visibility, combined with the difficulty of switching vendors, creates a potent combination of vendor lock-in and unmanaged risk.

The operational impact is already measurable. Respondents reported an average of six AI-related disruptions over the past two years, primarily triggered by vendor-side issues such as price increases, usage restrictions, model deprecations, and performance degradation. More alarmingly, 81% said that a seven-day outage of their primary AI vendor would cause severe or critical disruption, effectively halting operations. In other words, AI has become a single point of failure for many enterprises, but without the contingency planning that typically accompanies mission-critical systems.

This dependency dynamic intersects with the growing regulatory pressure around data sovereignty. As countries enact stricter data localization laws, organizations must ensure AI workloads comply with residency requirements. The study’s finding that 68% see this as a major challenge underscores how governance complexity is compounding vendor lock-in. Enterprises not only depend on a few AI providers but also face legal hurdles when trying to move data or models out of certain jurisdictions, making the technical difficulty of switching even more pronounced.

The concept of AI sovereignty, championed by IBM in the study foreword by Senior Vice President Ana Paula Assis, frames the issue as an economic and strategic imperative, not just a technical one. Assis argues that loss of control can translate directly into margin pressure, compliance exposure, and outright business disruption. The study’s segmentation of organizations into different AI control profiles suggests that companies proactively designing sovereignty into their AI architecture—through multi-vendor strategies, open standards, and transparent monitoring—are better positioned to manage costs, maintain resilience, and accelerate innovation.