Security teams keep asking AI vendors one question. Most answers are mush.

I've been in a bunch of security reviews for AI agents lately, and the question that trips vendors up isn't about encryption or SOC reports.

It's simpler: "where exactly does our data go, and who can see it?"

The mushy answers sound like "we take privacy seriously".

The good ones are boring and specific: which systems the agent reads, what leaves the network, how long logs live, who can replay a decision.

Ngl, I get why security teams are tired. IBM's 2025 breach report found 97% of orgs that had an AI-related breach lacked proper AI access controls.

That's not a model problem, that's a plumbing problem.

For some teams the only answer that passes is keeping everything inside their own walls, which is why running agents on-premise keeps coming up in our calls.

What's the question your security team asks that vendors keep fumbling?