Les logiciels fantômes sont gratuits à tester, mais coûteux à réparer.

Vaporware is a security risk, not just a disappointment

Vaporware is AI announced, demoed and marketed before it has been proven in production. Not every immature feature is insecure, but an unproven one offers no evidence that it is secure. In EHS and ESG that gap matters, because rushed features, and ordinary tools relabeled as “AI” or “agentic”, can ship without a proper threat model.

Security is easy to under-invest in when speed and price are the priority, and governance gaps are common. According to IBM’s 2026 report, 68 % des organisations victimes de violations de données lacked policies to oversee AI use or manage unapproved “shadow AI”. Here is what rushed AI tends to leave out:

• No defined data path. Nobody can say what the AI reads, where it runs or who else can see the output.
• No permission model. The AI sits outside the platform’s roles and access controls, so it can reach more than the person using it should.
• No human checkpoint or log. Actions happen without review, and there is no record of what was done.
• No independent proof. Security is asserted, with no audit report, test result or certificate behind it.

Well-secured AI in EHS and ESG tends to be unglamorous: governed, logged and tied to the same permissions as everything else. If the pitch is more exciting than that, it is worth asking what was skipped.

The cost of skipping is lopsided. According to IBM, the global average cost of a data breach reached a record 4.99 millions de dollars en 2026, and breaches involving unapproved AI tools averaged 5.39 millions de dollars. Set against that, a saved sprint or license fee is small. For EHS teams, the downside is not only financial.

October was a reminder that every layer under your software can fail, AI or not. According to CISA, two critical flaws in a widely used web language let attackers run code without logging in. Help Net Security reported private keys at a certificate authority so weak that researchers recovered them in under a second. And the maintainers’ own rapport d'incident describes an AI gateway release that carried credential-stealing malware. None of these was an AI vaporware failure, but each shows why access limits, key control and release discipline matter.

Five requirements for enterprise-ready AI

These five capabilities are a fair test of whether AI is ready for EHS and ESG data. Ask for evidence of each.

The first two rows deserve extra attention. According to IBM’s 2026 report, many AI-related breaches stemmed from weaknesses in surrounding controls, such as cloud misconfigurations, compromised APIs and insufficient access controls.

These five requirements are the bar every vendor should be held to, including us.

How Benchmark Gensuite approaches enterprise-ready AI

The difference between AI added to disconnected systems and AI built into one governed, connected platform is how many seams your data has to cross. Native integration alone does not guarantee security, so here is what we publish and where you can check it.

Every row can be checked against our published pages, and we would rather you check than take our word for it.

Three questions to ask before AI touches your data

AI is moving deeper into EHS and ESG work, and the benefits can be significant. So can the exposure. Whichever vendor you evaluate, ask for documented answers to three questions:

• Where does our data go? Ask for AI processing locations, providers and sub-processors, and whether your data trains any model.
• Who and what can access and change it? Check permissions, agent access, human approval steps and audit trails.
• What proves it is ready? Ask for production deployments, current SOC 2 and ISO 27001 reports, penetration test results and vulnerability management.

AI that cannot answer them is not ready for your data, however good the demo looks.