TL;DR: Ten security teams between January and August 2026 described an AI estate spread across several vendors, and almost none of them picked that on architecture grounds. Acquisitions and business unit autonomy built it, along with whatever procurement signed years ago. Advice written for one stack doesn't survive contact with it, so put your controls where every vendor has to cross.
Most AI security advice assumes you picked one AI vendor. In ten calls since January 2026, not one team had. The estate was multi-vendor because the business made it that way, and nobody in security got a vote.
The phrase that stuck with me came from a hospital system in January 2026. Multi-cloud by business dictate, not architecture choice.
That's a different problem than the one most reference documents are written for.
What is a heterogeneous AI estate?
It's an environment running AI from several vendors at once, usually across more than one cloud, with different teams owning different pieces. One business unit is on one provider's models. Another bought a software tool with AI baked in, and a research group is running open weights on its own hardware. None of it was designed as a whole.
The word heterogeneous is doing real work there. It doesn't mean messy. It means the parts came from different places and don't share a control surface, so a policy you set in one console covers a fraction of what's running.
An insurance carrier described their version in August 2026 as the wild wild west. That's a fair read of an estate where four teams each made a reasonable local decision.
Why do companies end up with more than one AI vendor?
Rarely because anyone chose sprawl. The estate accumulates. A company buys another company and inherits its cloud. A business unit with its own budget moves faster than central IT. A vendor the company already pays for adds AI features to a product nobody re-evaluated.
Regulatory and data residency requirements push work to specific providers in specific regions. Cost pressure pushes some workloads to cheaper models. A team that hit a rate limit on one provider added a second one as a backup and never removed it.
Every one of those decisions was defensible in isolation. The estate is the sum of defensible local decisions, which is why arguing about whether it should exist is a waste of a meeting.
Why does single-vendor advice fail on a mixed estate?
Because it assumes the control lives in a console you own. Most vendor guidance tells you to enable a setting in that vendor's admin panel. That instruction is correct and it covers only the traffic passing through that vendor, which on a mixed estate might be forty percent of what's actually running.
The result is a security team that has done everything the documentation said and still can't answer basic questions. Which models is the company sending customer data to? Nobody knows, because the answer lives in four consoles and one of them belongs to a business unit that doesn't report to them.
A hospital system security leader gave the sharpest version of this in January 2026. If a vendor says they do it all, they lie. There's no single solution. He'd gone looking for a reference architecture that covered AI end to end and found that nothing satisfied it.
Which controls actually work across every vendor?
Four layers, and they share one property: every vendor has to cross them. You put the control where the traffic and the identity go, not where the vendor's admin panel is.
Identity. Every AI system, agent, and integration authenticates through your identity provider rather than a per-vendor account. This is the one that pays for itself, because it gives you one place to see and revoke access across the whole estate.
Egress. What leaves your network, to which endpoint, carrying what. Vendor-neutral by definition. It's also the only honest inventory most companies can build, because it shows the tools nobody registered.
Logging into one place. Ship logs from every AI system into a single store you own. Vendor dashboards are fine for operations and useless for a cross-estate investigation at two in the morning.
Data classification at the source. Label data where it lives, before any model touches it. A classification that travels with the data works no matter which provider is on the other end of the call.
None of these are new controls. That's the point. The estate changed and the control layers didn't, which means the work is mostly applying things you already run to a set of systems that skipped the process.
What about the vendor that says it covers everything?
Treat the claim as a scoping question rather than a yes or no. Ask which of your providers it inspects, what it does with traffic to a model it doesn't recognize, and whether it sees anything running outside the cloud.
A university security team told me in August 2026 that everybody had a good opinion about a particular data security platform and they hadn't found anyone who'd actually deployed it. That's a useful signal, and it's why peer references beat product demos on this category.
The pattern I'd watch for: a tool that covers your largest provider beautifully and treats the other three as unknown traffic. That isn't coverage. It's coverage of the part you were already watching.
What can you do this week?
List your AI vendors, then ask finance. Your list will be shorter than the expense report. The difference is the part of the estate you've been writing policy for without knowing it exists.
Check which AI systems authenticate through your identity provider. Anything using its own local account is outside your revocation path, which is the control you'll want most on a bad day.
Pull a week of egress to model endpoints. No agent needed, no procurement. Existing network logs, filtered. It's the fastest inventory available to most teams.
Pick the control layer you're weakest on and fix that one. Not all four. The estate isn't getting simpler, so depth on one layer beats a shallow pass across everything.
Stop rewriting policy per vendor. Write it once against the four layers. A policy that names a specific provider will be stale the next time procurement signs something.
Key takeaways:
Ten security teams between January 30 and August 19, 2026 described an AI estate spanning several vendors, and almost none of them designed it that way.
Acquisitions, business unit budgets, and vendor product changes build the estate faster than any architecture decision can.
Single-vendor guidance is correct and incomplete, because it only governs traffic passing through that vendor's console.
Identity, egress, centralized logging, and data classification are the four layers every vendor has to cross.
A tool that covers your biggest provider and ignores the rest is covering the part you could already see.
Frequently asked questions
Should we consolidate onto one AI vendor?
Usually you can't, and trying costs more than it saves. The estate exists because of acquisitions and rules you don't control. Consolidating the control layers is achievable this year. Consolidating the vendors generally isn't.
How do I find AI systems nobody registered?
Egress logs and the expense report, in that order. Network traffic to model endpoints shows you what's running right now. Finance shows you what somebody's paying for, including the tools that added AI features to a product you bought years ago.
Does Zero Trust help with a multi-vendor estate?
It's the right foundation, because verifying every request against identity and context doesn't care which vendor is on the other side. Agents add one more check on top: a series of individually valid requests can still add up to something nobody approved.
What's the biggest mistake teams make here?
Writing policy per vendor. You end up with four documents that disagree, and a new document owed every time procurement signs a contract. Write it once against the control layers and let the vendor list change underneath it.
How much of this needs new budget?
Less than you'd guess. Identity, egress monitoring, and log centralization are usually things a company already pays for and hasn't extended to AI systems. The work is scope and configuration more often than it's a purchase order.
Where should a small team start?
Identity. If every AI system authenticates through your identity provider, you get inventory and revocation from one change. Everything else is easier once you can see and switch off access from a single place.
The estate you have is the one the business built, and it will keep changing without asking you. Controls tied to a vendor name expire on the next acquisition. Controls tied to identity and egress are still standing when the vendor list looks nothing like it does today.