Red Hat Survey Shows Blind Spots in Swiss Enterprise Software Supply Chains

Red Hat, the world's leading provider of open source solutions, has announced the results of a survey examining enterprise artificial intelligence (AI) adoption and risk management across 1,400 CIOs across 14 countries, including Switzerland. The research indicates that while autonomous AI agents are rapidly moving into enterprise production, with 100% of Swiss businesses surveyed stating that they are already deploying agents in production, a critical gap persists between perceived governance and actual operational visibility.

The majority of Swiss CIOs surveyed (95%¹) report high confidence that their AI agents operate securely and in compliance with regulations, supported by guardrails and monitoring. However, the data highlights that this optimism can mask a lack of visibility:

• 45% of respondents report having a precise understanding of data flows within their organisation and the knowledge of where data is stored and processed with comprehensive visibility into associated data flows across their technology environment.
• Nearly four in ten (38%) have a comprehensive overview of their software supply chain as well as direct and indirect dependencies.
• Almost half (49%) continuously assess the risks posed by AI providers, beyond initial onboarding.

These results indicate that while survey respondents feel that their AI agents and environments have appropriate security and sovereignty controls, the reality shows a lack of auditable proof in these operations. The dynamic nature of AI innovation and market forces make it possible for a system to have high levels of security and compliance at deployment, but then be completely exposed soon after.

Small gaps in visibility, major risk to data

Swiss enterprises are accelerating their AI adoption curve, with 46% of respondents stating they can fully rely on tested guardrails, continuous monitoring and automated intervention mechanisms. A further 49% of Swiss companies are 'fairly confident' that they have security and compliance under control, but acknowledge minor gaps in their guardrails and monitoring.

In production environments, however, unmonitored data exchanges between enterprise platforms, cloud services, and external AI models can create risks. 47% of Swiss companies report minor gaps in the visibility of data flows; 8% have already introduced AI functions without full visibility into associated data flows.

Comparatively, visibility varies widely across borders: while 61% of respondents in South Africa claim end-to-end data flow visibility, French organizations trail at 31% (Switzerland: 45%). For Swiss enterprises navigating stringent regulatory environments like GDPR and the EU AI Act, establishing verifiable, lifecycle-wide data traceability remains essential to avoid non-compliance and data leaks.

The great risk of indirect software dependencies

As many as 85% of Swiss companies surveyed report that they are able to patch critical software vulnerabilities within 24 hours once a fix becomes available. The remaining companies take a few days, with none indicating that it takes longer than three days.

However, most companies do not know exactly which software components are in use. Only 38% have a complete and constantly updated overview of all the open source components they use, including their origin, version numbers and direct and indirect dependencies. Across all the countries, the average figure is just under 33%.

Whilst 51% of in-region companies have a good overview of the components and versions, they note concessions when it comes to understanding origins and indirect dependencies. 23% of respondents lack a complete overview, partly because they focus on components from large projects or because visibility depends heavily on the specific applications or business units using them.

Indirect dependencies are common in many open source software projects, meaning that they incorporate libraries, frameworks and other components from other projects. These dependencies can often pose significant risks for an organization's IT estate, especially if they are not effectively evaluated (62%²).

Risk assessments as an ongoing rather than a one-off task

When it comes to assessing risks posed by AI providers, only 49% of Swiss companies report that they are well-prepared and have measurable, continuously monitored criteria as part of their day-to-day AI operations. This is significantly more than in the Netherlands, for example (just under 22%), but slightly less than in Italy (51%).

Although 44% of companies surveyed in Switzerland conduct a risk assessment before implementing new AI technologies, they struggle to monitor and evaluate those risks afterward. 21% rely solely on an initial evaluation, which can be insufficient in the rapidly evolving world of AI, as models, data, regulatory requirements and threats change almost daily.

This challenge and the need to address it through measurably, internally-controlled methods is not lost on survey respondents. Only 1% of Swiss companies rely solely on external audits, certifications and contractual assurances for their risk assessments. 7% conduct security, compliance and data governance assessments, but do not continuously monitor provider risk.

Quote

Eduard Modalek, country manager, Switzerland, Red Hat

"In our survey, the vast majority of Swiss companies express confidence in their ability to effectively monitor and control AI agents. However, this confidence in their own capabilities is not always justified, with our research showing a lack of comprehensive and continuous transparency regarding data flows, software dependencies and vendor risks. Open architectures with centralized management can, however, help companies maintain control and remain flexible when selecting models and providers."

1 Combines 'Very confident - we have tested guardrails, continuous monitoring and mechanisms to intervene or stop agents when required' and 'Fairly confident - we have guardrails and monitoring in place, but some gaps remain'

2 Combines 'We have good visibility into components and versions, but limited visibility into their origins or indirect dependencies', 'We know which major open source components we use, but do not have a complete view of the wider software supply chain', 'We have limited visibility into the open source components and dependencies used across our critical applications',' We do not systematically track our open source software supply chain'

Methodology: The survey was conducted by Censuswide among 1,400 CIOs (25+) across the UK, France, Italy, Germany, Spain, the UAE, Sweden, Turkey, Switzerland, Poland, South Africa, the Netherlands, Belgium, and Saudi Arabia between August 24, 2026, and September 1, 2026. Censuswide is a member of the Market Research Society and the British Polling Council, and a signatory to the Global Data Quality Pledge.