82% of organisations have developed plans to use generative AI in their data security measures. That's up from 64% just a year ago, according to Microsoft's Data Security Index 2026.
Yet most get stuck. The pilot went well, but then nothing happens.
IDC's Frontier Firms study confirms the pattern. Only 22% of organisations globally are classified as "Frontier firms" — those already realising measurable returns on their AI investments. In Europe, the figure is even lower: 18%. Half of European companies fall into the "laggards" category, still in the exploration or planning phase. The gap between those who test and those who deliver is growing.
I've seen this pattern for 30 years, across different industries and technologies. It's rarely about the technology. It comes down to three things.
1. Ownership
The pilot is driven by an enthusiast in the IT department. But when it's time to scale, the business needs to own the question. Who is the sponsor? Which process should be improved? If the answer is "we want to test AI" instead of "we want to cut support response times by 40%", the connection to business outcomes needed to move forward is missing.
2. Data
Or rather, a lack of order in data. 29% of decision-makers in Microsoft's report cite poor integration between data security and data management platforms as their biggest challenge. 25% lack a unified overview. You can't build an AI assistant that answers questions about your policies if those policies are spread across 14 different systems, three of which haven't been updated since 2019.
3. Expectation management
AI doesn't solve everything on day one. The first version of your AI assistant might answer correctly 70% of the time. That means it gets it wrong 30% of the time. Organisations that survive that phase — that iterate and improve rather than shut it down — are the ones that end up with a tool that actually transforms operations.
IDC's data shows that Frontier firms realise ROI within an average of 15 months. Not day one. Not even after six months. But those who persist and iterate see the returns come.
What determines success?
At Walma, we've onboarded municipalities, property companies and security firms. What always determines success isn't our technology. It's that the customer has a person who owns the question, data that can be worked with, and patience to iterate.
If you're sitting with a successful pilot that hasn't moved forward, don't start with the technology. Start with the question: who in the business wakes up in the morning and cares that this works?
