A pattern where organisations experiment with AI through demos, prompts, and pilots without redesigning the underlying process for production use. The result is visible activity but limited operational change, because the system remains dependent on human workflows and does not absorb meaningful business work.
Expanded Definition
AI Tourism describes organisational activity that looks like AI adoption but stops short of operational redesign. Teams may build demos, write prompts, or run pilots, yet the core workflow, control plane, and decision rights stay unchanged. The result is activity without durable automation.
In NHI and agentic ai governance, the term matters because real production use depends on identities, permissions, tool access, logging, and exception handling. A pilot that never connects to governed data sources or execution paths is not yet an operational AI capability. That distinction is consistent with the broader control thinking in the NIST Cybersecurity Framework 2.0, where outcomes must be embedded into repeatable processes rather than isolated experiments.
Definitions vary across vendors, and no single standard governs this yet, but the practical test is whether AI changes how work is completed when humans are not in the loop. The most common misapplication is labeling a proof of concept as transformation, which occurs when a demo is presented as production-ready despite no redesign of access, approvals, or recovery paths.
Examples and Use Cases
Implementing AI rigorously often introduces governance, integration, and security overhead, requiring organisations to weigh speed of experimentation against the cost of turning the pilot into a controlled production service.
- A customer support team uses an LLM to draft replies, but an agent still copies, edits, and sends every message manually.
- A finance group tests invoice summarisation, yet the approval workflow, exception routing, and system of record remain entirely human-run.
- An internal chatbot answers policy questions, but it has no governed access to authoritative sources, so users still verify everything in email and spreadsheets.
- A product team showcases an agent demo, but the underlying service account, secrets, and audit logging are not ready for real tool execution.
- An operations team experiments with AI-assisted triage, but the escalation path still depends on a person reviewing every alert before action is taken.
These patterns are visible in current NHI failure modes as well. NHIMG’s DeepSeek breach analysis shows how quickly exposed AI-related infrastructure can become a security event when experimentation outpaces control design. For implementation context, the NIST Cybersecurity Framework 2.0 remains a useful reference for moving from ad hoc activity to repeatable governance.
Why It Matters in NHI Security
AI Tourism is not harmless theatre. When teams stop at demos, they create a false sense of readiness while still depending on fragile human workflows, unmanaged prompts, and often ungoverned secrets. That gap is especially risky in NHI environments, where agentic systems need durable identities, scoped permissions, and traceable execution to do real work.
NHIMG research in The State of Secrets in AppSec reports that the average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities. That kind of confidence gap matters because AI Tourism often coexists with weak operational controls: prompts are shared informally, API keys are reused, and experiments are left exposed after the pilot ends. The security issue is not merely that AI is underused, but that pseudo-adoption hides the absence of accountable identity and access design. Organisations typically encounter the consequences only after a leaked key, exposed model endpoint, or failed agent action, at which point AI Tourism becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.1 | AI Tourism exposes weak governance when pilots are not translated into managed operational outcomes. |
| NIST Zero Trust (SP 800-207) | SC.L2 | Production AI needs explicit trust boundaries, not demo-era assumptions about access and execution. |
| OWASP Non-Human Identity Top 10 | NHI-01 | Toy AI deployments often ignore identity lifecycle, secret handling, and service account controls. |
| OWASP Agentic AI Top 10 | A1 | Agentic systems fail when experimentation skips tool access, autonomy, and control boundaries. |
| NIST AI RMF | This term reflects the gap between AI experimentation and managed risk, a core RMF concern. |
Inventory AI identities and secrets early, then harden them before any pilot becomes a workflow dependency.
