AI adoption is outrunning governance and measurable business value

At a glance

What this is: This analysis says AI adoption is expanding faster than organisations can measure returns, govern usage, or prove that controls are working.

Why it matters: For IAM, NHI, and security teams, the issue is that AI governance now needs runtime visibility, enforceable controls, and audit evidence, not just policy.

Context

AI adoption is expanding faster than many organisations can prove value, control usage, or demonstrate that the right guardrails exist. The governance problem is not simply how to approve more AI, but how to make AI activity visible, enforceable, and measurable across business workflows.

WitnessAI frames this as an AI adoption-impact gap: enterprise teams can see spending and usage rise, but they often cannot show which AI activity changed outcomes, reduced cost, or introduced new exposure. That creates a governance and measurement problem for IAM, security, and compliance leaders alike.

The article’s underlying point is that legacy approval and audit models were built for deterministic software, not for runtime AI behaviour that changes at speed. That mismatch becomes more acute as AI use spreads beyond approved pilots into shadow usage and agentic workflows.

Key questions

Q: How should security teams govern AI use in developer tooling?

A: Security teams should govern AI use as a data and access problem, not only a productivity feature. Define what information can be sent to models, require human review of generated code, and apply least privilege to connected repositories and tools. Approved use cases should be explicit, monitored, and revisited as model capabilities expand.

Q: Why do organisations struggle to prove ROI from enterprise AI?

A: They often lack telemetry that links prompts, models, workflows, and decisions to measurable business outcomes. Spend is easy to report, but value is hard to prove when no one can trace what changed because AI was involved. Without that evidence, AI investment discussions default to anecdotes rather than defensible operational results.

Q: What breaks when organisations cannot see shadow AI usage?

A: When shadow AI is invisible, security teams lose control over where data is sent, which assistants are connected, and whether those systems can retain or expose sensitive information. That undermines policy enforcement, auditability, and incident response. It also means the organisation may be granting machine-driven access without a defined identity lifecycle.

Q: How can organisations tell whether AI governance is actually working?

A: Organisations can tell AI governance is working when they can inventory every agent, explain its purpose, show who owns it, and prove that permissions are tightly scoped. If those four things are missing, the programme has policy language but not operational control. Auditors will notice the gap quickly.

Technical breakdown

Why deterministic approval models break for AI

Traditional governance assumes software is requested, approved, deployed, and then reviewed on a stable cadence. AI usage is different because prompts, model responses, embedded copilots, and agent actions can change continuously and at runtime. That makes static approval workflows a poor fit for risk decisions that need context, intent, and evidence at the moment of use. The core failure is not lack of policy, but lack of operational control over real interactions. Practical implication: move governance closer to runtime decisions, where AI activity can be evaluated in context rather than only at procurement time.

Practical implication: treat AI governance as a runtime control problem, not a one-time approval exercise.

How shadow AI expands the identity and access problem

Shadow AI appears when employees use unsanctioned AI tools, native desktop apps, embedded copilots, or agentic workflows outside approved channels. That matters because the organisation loses inventory, control, and auditability the moment AI usage leaves the visible approval path. In identity terms, the organisation no longer knows which human, service, or agent is exercising access over sensitive data or model interactions. Practical implication: security teams need inventory and telemetry that can detect AI use outside browser-only monitoring and tie activity back to accountable identities.

Practical implication: build discovery and telemetry that reveal unsanctioned AI use across users, apps, and agents.

Why measurement is now part of AI governance

The article shows that many organisations can report spend but cannot link prompts, models, and workflows to actual business outcomes. Without interaction-level telemetry, AI value claims stay anecdotal and risk discussions remain abstract. Measurement is not a finance-only concern, because the same data needed to prove value also supports policy enforcement, auditability, and incident investigation. Practical implication: instrument AI activity so governance can answer who used what, where data went, and what changed as a result.

Practical implication: make AI telemetry part of governance evidence, not just reporting.

NHI Mgmt Group analysis

AI governance now fails at the point of interaction, not at the point of policy: The article shows that organisations can write policies faster than they can prove those policies affect real AI usage. That matters because runtime AI activity is where data exposure, policy violation, and value creation all happen together. The implication is that governance must be measured where the interaction occurs, not where the approval form is filed.

Shadow AI is a visibility failure before it is a control failure: The most important risk signal is not simply that employees use unapproved tools, but that the organisation cannot inventory them reliably. Once AI activity spreads beyond approved channels, accountability becomes partial and enforcement becomes inconsistent. Practitioners should read this as an inventory and telemetry problem across human, workload, and agentic access paths.

Operational AI risk management is the missing discipline between adoption and accountability: The article distinguishes governance, compliance, and risk management as separate functions, and that distinction is correct. Governance sets intent, compliance checks adherence, but risk management is the continuous work of controlling live behaviour. The field needs to treat AI risk management as an operating model, not a document set.

Runtime evidence is the new control plane: AI programmes cannot defend themselves to boards or regulators if they lack interaction-level evidence. Prompt, response, and policy-enforcement records create the audit trail that makes AI controls testable rather than aspirational. For practitioners, this shifts the centre of gravity from policy approval to provable enforcement.

AI adoption without measurable outcome tracking will keep producing pilot purgatory: The article’s broader signal is that spending alone does not create value, and value cannot be claimed without traceable outcome data. That means security, IAM, and finance teams need a shared evidence model for AI usage, not parallel narratives. The practical conclusion is that organisations must align control, telemetry, and business outcome measurement before scaling further.

From our research library:

• Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
• Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
• Read next: Service Account Security Guide

What this signals

Runtime AI governance is becoming the practical test of programme maturity: Policies that cannot observe and influence live AI interactions will not survive operational pressure. The programme question is no longer whether AI should be allowed, but whether it can be governed at the point where work happens.

Visibility has to extend beyond browser traffic: Native applications, IDEs, and agentic workflows create blind spots that traditional controls do not see. Once those paths are invisible, every downstream control becomes weaker because the organisation cannot prove where AI is being used or by whom.

Outcome measurement and control evidence now belong in the same operating model: The organisations most likely to scale AI safely will be those that can connect usage telemetry to business impact and enforcement records. Without that linkage, leaders will keep funding experimentation while struggling to justify production expansion.

For practitioners

• Define runtime AI governance as an operational control Treat AI usage as something to be observed and enforced during the interaction, not only approved in advance. Tie governance decisions to live prompts, responses, and workflow context so the control can follow actual behaviour.
• Inventory AI activity across all execution paths Expand discovery beyond browser traffic to cover native applications, IDEs, embedded copilots, and autonomous agents making API calls. Build a complete inventory of where employees and systems are actually using AI.
• Separate policy approval from enforcement evidence Keep the policy statement, the enforcement action, and the audit trail distinct so the organisation can prove controls worked rather than only showing that rules exist. Capture interaction records that show what was allowed, warned, blocked, or routed.
• Measure AI outcomes alongside AI spend Pair usage telemetry with business outcome tracking so teams can connect AI activity to productivity, quality, cost, or risk results. Use that evidence to distinguish real impact from activity that only looks productive.
• Build controls for shadow AI before scaling more approvals Focus on reducing ungoverned usage paths before adding more review gates. A tighter approval process without visibility tends to push activity further out of sight.

Key takeaways

• Enterprise AI is creating a governance gap because usage is rising faster than organisations can observe, control, and audit it.
• The core problem is not adoption alone but the lack of runtime evidence that ties AI activity to business outcomes and policy enforcement.
• Teams that want production value need discovery, enforcement, and measurement to operate together rather than as separate governance exercises.

Key terms

• Runtime AI Risk Management: The ongoing operational discipline of identifying, controlling, and evidencing AI risk while the system is in production. It focuses on live prompts, responses, policy outcomes, and audit trails rather than static policy documents or one-time approval decisions.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Runtime Governance: Runtime governance is the set of controls that verify what a system or agent is actually doing after deployment. It combines monitoring, authorization checks, and access validation so teams can detect drift, misuse, or excessive privilege in motion rather than assuming build-time policy still holds.
• Interaction-Level Telemetry: Evidence captured at the point where a person or system interacts with an AI model, including prompts, responses, and control decisions. It lets teams explain what happened, why it was allowed or blocked, and whether governance actually worked in production.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity security programme, it is worth exploring.