Skip to main content
The annual flagship whitepaper of OrcaRouter Security Research — a study of how enterprises are attacked through their AI systems, and the control architecture that contains it. 35 pages, and every statistic is cited to a named public source (IBM, Gartner, WEF, McKinsey, Stanford HAI, FBI IC3, OWASP).

Download the report (PDF)

The full report — A4, 35 pages, the designed reference edition.

​
What’s inside

Ch. 1 — The state of AI security in 2026

Adoption vs. governance, and the 2023→2026 incident record.

Ch. 2 — A taxonomy of AI threats

14 threat classes, 4 families, mapped to the OWASP LLM Top 10.

Ch. 3 — Anatomy of the modern AI attack

The AI kill chain + three case files: zero-click exfiltration, MCP rug-pull, denial-of-wallet.

Ch. 4 — The agentic inflection point

Agents, MCP, excessive agency, and shadow AI.

Ch. 5 — The defense blueprint

Zero trust for AI: the OrcaRouter reference control stack, an observe→shadow→enforce rollout, and an OWASP / NIST / EU AI Act / ISO 42001 crosswalk.

Ch. 6 — The CISO agenda for 2026

A 12-month roadmap, KPIs, and ten questions for the board.
Plus methodology, a threat-reference appendix, a glossary, and 39 endnoted sources.