Less Than Half of Companies Have Trained Employees on How to Evaluate AI Outputs, New Riskonnect Research Finds

Riskonnect’s 2026 survey of more than 250 risk, compliance, and resilience professionals found that 55% cited economic risk as a severe or significant business threat, tying with cybersecurity for the first time. AI governance and training remain uneven: 72% have an employee-use policy, but only 46% train employees to evaluate AI outputs, and 58% of companies considering agentic AI have not assessed its risks. Meanwhile, 74% use or plan to use AI for risk management, while 75% say pressure on risk leaders increased over the past year.

Analysis

The investable signal is a widening gap between AI deployment and control capacity—not proof of near-term software revenue growth. That gap can raise demand for governance, auditability and cyber controls, but flat technology budgets favor bundled tools and incumbent platforms over another standalone risk application. Riskonnect’s vendor-sponsored, self-reported survey is a weak basis for sizing that demand; adoption plans are not purchase orders.

Second-order risk runs both ways: using AI to scale risk review may expose firms to faster propagation of bad outputs, model errors and unclear accountability. In parallel, economic and geopolitical shocks can squeeze margins through energy, freight and input costs; companies making siloed procurement or technology decisions may amplify those exposures. This favors firms with pricing power, diversified sourcing and disciplined controls—not risk software indiscriminately.

Near term, expect limited sector repricing from this release alone. Over 1–3 months, watch enterprise-software commentary for measurable governance-related bookings and security budgets. Over 6–18 months, liability, regulation or a prominent AI-control failure could accelerate spending, while budget constraints and platform bundling could cap specialist vendors’ upside. The contrarian point: policy adoption may look like readiness, but practical training and assessment gaps suggest execution risk remains underpriced. No direct trade is justified without company-level revenue exposure and evidence of paid demand.

Key Decisions for Investors

• No trade on the report alone: treat it as a watch signal, not a demand estimate. Riskonnect is not identified in the supplied company mapping, so do not infer a listed-company catalyst.
• Monitor enterprise software and cybersecurity earnings for explicit AI-governance bookings, renewal rates and budget conversion; favor evidence of monetization over survey-based adoption claims.
• For portfolio risk, review exposure to energy, freight and concentrated suppliers alongside AI-use controls. Escalate if management reports rising costs, delayed shipments or material control failures.
• Falsification/watch items: governance-related spending remains bundled or deferred, enterprise software guidance does not improve, or regulatory and incident-driven demand fails to translate into paid deployments.