AI adoption gap exposes enterprise data risk in agentic workflows

At a glance

What this is: Cyberhaven's report maps the widening gap between rapid AI adoption and the controls needed to govern sensitive data exposure in agentic workflows.

Why it matters: It matters because identity, access, and data governance teams now have to control AI use as operational access, not just shadow experimentation, or sensitive data will keep flowing into unmanaged tools.

By the numbers:

• Frontier enterprises are now utilizing over 300 GenAI tools.
• In leading organizations, 71.4% of employees use GenAI.
• 82% of the top 100 most-used GenAI SaaS applications are classified as medium to critical risk.
• 39.7% of all AI interactions involve sensitive data.

Context

AI adoption has moved beyond pilots and prompts into day-to-day business use, which changes the security problem from experimentation to governance. Once employees and developers rely on AI tools for ordinary work, those tools become part of the data path, the access path, and the decision path, so unmanaged use turns into persistent exposure risk.

The key governance gap is that usage is scaling faster than inventory, classification, approval, and monitoring. For identity and security teams, the relevant question is no longer whether AI is permitted, but which accounts, datasets, and workflows AI can touch, and whether those permissions are bounded tightly enough for human and machine use alike.

Key questions

Q: What breaks when employees use unapproved AI tools with company data?

A: Governance breaks because the organisation loses visibility into where data and secrets are going, who can access them, and how they are being reused. Unapproved tools can copy credentials into unmanaged workflows, which weakens revocation and makes audit trails incomplete. The result is shadow access outside the main identity programme.

Q: Why do agentic workflows increase data-loss risk in regulated environments?

A: Because the agent can be authorised to act while still being unsafe in practice. Once a tool call, prompt or connected system can access customer records, financial data or confidential documents, the risk is not only theft but unintended propagation, summary leakage and policy bypass across multiple applications.

Q: What do security teams get wrong about AI governance reviews?

A: They often treat every use case as if it needs the same level of scrutiny. That creates bottlenecks and does not reflect actual risk. Effective governance separates routine, low-risk activity from higher-risk systems and uses runtime controls for interactions that can be governed continuously instead of repeatedly reviewed.

Q: How should organisations govern access to data used by AI systems?

A: Treat AI data access as an identity governance problem, not just a data storage problem. Define who or what can use each dataset, what purpose is allowed, and what runtime restrictions apply. Then review humans, service accounts, and AI agents separately so entitlement scope matches actual behaviour rather than a generic AI policy.

Technical breakdown

Why AI adoption becomes a data governance problem

When AI tools move from testing to routine work, they inherit the same governance problems that apply to any high-value application: who can use them, what data they can see, and how their outputs are retained or reused. In practice, the risk is not just model behaviour. It is the combination of broad access, unsanctioned accounts, and users pasting sensitive material into systems the security team may not fully inventory. That is why AI adoption must be treated as a control-plane issue, not a feature decision.

Practical implication: classify AI tools, tie them to approved identities, and govern the data they can ingest before usage becomes embedded.

Agentic workflows widen the identity and privilege boundary

Agentic workflows are different from static SaaS use because an AI system may act across multiple tools, accounts, and data sources in a single task. That creates a new privilege boundary: the agent may not merely read information, but move it, transform it, or trigger downstream actions. Traditional app governance assumes a stable user and a stable session. Agentic use breaks that assumption by making permissions more fluid, more distributed, and harder to review after the fact.

Practical implication: assign explicit identity and authorization rules to AI agents, not just to the humans who request them.

Sensitive data exposure follows from overbroad access, not just model risk

The report’s exposure pattern points to a familiar but increasingly urgent control failure. Sensitive information leaks when users combine unsanctioned AI usage with permissive access to files, messages, code, and business systems. Once the data is in the prompt stream or agent context, downstream retention, logging, and third-party handling become part of the risk surface. That means the governance question is as much about data permissions and context injection as it is about prompt filtering or content moderation.

Practical implication: limit which repositories, documents, and production systems AI tools can access, then monitor what data reaches them.

Threat narrative

Attacker objective: The practical objective is not always direct compromise but uncontrolled exposure of proprietary, regulated, or operationally sensitive data through AI-enabled workflows.

1. Entry occurs when employees and developers use sanctioned or personal AI accounts to access SaaS tools, coding assistants, or agent-building platforms.
2. Credential and context access expand when those tools are granted broad access to files, prompts, browser sessions, or connected services, creating a large trust boundary for sensitive data.
3. Impact emerges when proprietary information is entered into AI systems, retained in context, or propagated into downstream workflows outside normal governance.

Breaches seen in the wild

• Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI adoption gap is now a governance debt problem: the article shows that AI usage is moving faster than most organisations can inventory, approve, and monitor. That creates a durable control deficit, not a temporary adoption spike. Security teams should treat AI tool sprawl as an access-governance issue, because unmanaged use expands the data path before policy catches up.

Agentic workflows shift identity from user-centric to action-centric: once AI systems can move through tools and data sources on behalf of people, the relevant control unit is no longer only the employee account. The security model must account for AI-mediated actions, delegated scope, and machine-to-machine trust. That makes AI agents a governance object in their own right, not just another application client.

Sensitive data exposure is a permissions problem before it is a model problem: the report’s findings point to overbroad access, personal-account use, and weak visibility into where AI is being used. Prompt hygiene matters, but it does not solve uncontrolled access to files, code, and business systems. The decisive issue is whether data permissions are constrained tightly enough for both human and agent use cases.

AI governance debt: this is the accumulated gap between how quickly organisations adopt AI tools and how slowly they define identity, access, and data controls for them. The longer that gap persists, the more ordinary work depends on ungoverned AI pathways. Practitioners should treat reduction of that debt as a core security programme outcome.

From our research library:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• According to PwC, 79% of organizations have already adopted AI agents to some degree.
• Read next: Agentic AI Identity Guide

What this signals

AI governance debt: the faster organisations adopt AI tools, the more control they accumulate in the wrong places unless identity, data, and session boundaries are defined up front. That creates a programme-level obligation to treat AI usage as governed access, not an employee convenience layer.

The immediate planning issue is visibility. Security teams need to know which identities are using which AI tools, whether those tools are personal or sanctioned, and what data they can reach before the workflow becomes business critical.

For practitioners

• Inventory AI usage across sanctioned and personal accounts Identify which AI tools employees are actually using, which identities they use to access them, and which business functions depend on them. That inventory should include code assistants, browser-based chat tools, and agent-building platforms.
• Restrict sensitive data paths into AI tools Apply data classification and access rules to block high-value repositories, regulated records, and production systems from reaching unmanaged AI contexts. Focus on the files, prompts, and connectors that carry proprietary information.
• Define explicit authorization for AI agents Treat agent permissions as distinct from human permissions and set scoped access for each workflow the agent can execute. Require approved identities, bounded connectors, and revocation paths before agents can interact with enterprise systems.
• Monitor for shadow AI and personal-account usage Track AI access through browser telemetry, SaaS logs, and DLP signals so that unapproved tools and personal accounts are visible. Prioritise services that can reach source code, customer data, or internal documents.
• Set policy for agentic workflow containment Document which data, actions, and downstream systems an AI workflow may touch, then test those boundaries under realistic use. If the workflow can move sensitive data, its containment rules need the same scrutiny as privileged access.

Key takeaways

• AI adoption now creates a governance problem when tools, accounts, and data pathways expand faster than security controls can be applied.
• The report shows that sensitive data exposure is already embedded in everyday AI use, which means risk management has to move upstream into access and data policy.
• Practitioners should focus on AI inventory, identity binding, and restricted data paths rather than relying on prompt guidance alone.

Key terms

• Agentic workflow: An agentic workflow is a sequence of tasks executed by an AI agent with some level of tool access and decision authority. In security terms, the workflow matters because it can span multiple systems, identities, and permissions, which makes attribution and revocation harder than with ordinary automation.
• API Governance Debt: API governance debt is the accumulation of weak, inconsistent, or missing controls around how APIs are designed, approved, documented, secured, and retired. It creates hidden risk over time. Technically, it includes gaps in authentication, authorization, versioning, inventory, ownership, logging, and policy enforcement that make APIs harder to trust and govern.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Delegated AI Authority: Delegated AI authority is the permission a person gives an assistant to act inside business systems on their behalf. It turns a conversational tool into an execution layer, which means security teams must govern scope, auditability, and revocation with the same seriousness they apply to privileged access.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and agentic AI identity. It helps practitioners align AI access controls with the identity and privilege decisions their programmes already own.