AI adoption is shifting from chat to agentic endpoints

At a glance

What this is: Cyberhaven says enterprise AI adoption is moving from chat to agentic endpoint use, with more data movement and faster growth in non-coding AI apps.

Why it matters: IAM, security, and data teams need to treat endpoint AI as a governance and control problem, not just a usage trend, because it changes access pathways and data exposure.

By the numbers:

• 37.7% of employees now use GenAI SaaS applications.
• Data movement events into and out of GenAI SaaS are up 80% year over year.
• Non-coding endpoint agentic app users grew 43.2%.

Context

Enterprise AI adoption is no longer concentrated in chat-based interactions. The security issue is now endpoint behaviour, where workers move data into and out of AI applications that can act with more autonomy than a prompt box ever implied.

That shift matters for identity and governance because the control problem changes from who can use AI to what AI-enabled workflows can touch, move, or trigger. In practice, unmanaged agentic apps create a new layer of access path sprawl, and that is becoming typical rather than exceptional.

Key questions

Q: What breaks when AI tools run locally without endpoint governance?

A: When coding assistants and MCP servers run locally, central gateways lose visibility into prompts, tool calls, and adjacent credentials. The result is a policy gap: approved use at the platform layer but unmanaged behaviour on the endpoint. Security teams then struggle to answer who accessed what, with which tools, and under what authority.

Q: Why does rising AI adoption increase security risk even when users are approved?

A: Approval of the user does not automatically govern the workflow. When AI tools can copy, transform, or forward sensitive content inside a session, the issue becomes what data the tool can touch and where it can send it. That is why adoption growth can coexist with a larger exposure surface.

Q: How can organisations tell whether AI governance is actually working?

A: Organisations can tell AI governance is working when they can inventory every agent, explain its purpose, show who owns it, and prove that permissions are tightly scoped. If those four things are missing, the programme has policy language but not operational control. Auditors will notice the gap quickly.

Q: How should organisations separate human intent from agent action on the endpoint?

A: They should treat the human session and the machine action as related but distinct events. The worker may initiate the task, but the agent can execute steps, move files, or trigger services. Governance should require logs that show who initiated the action, what the agent did, and whether the result stayed within policy.

Technical breakdown

Why endpoint agentic AI changes the control model

Endpoint agentic AI differs from chat-based GenAI because the application does not just answer a question, it can execute workflow steps, interact with files, and sustain a task across multiple actions. That creates a broader trust boundary than classic SaaS usage, where the main concern is user input and output. Once the AI client sits on the endpoint, data can move through local apps, browser sessions, and connected services in ways that are harder to centralise or review. The practical difference is that policy enforcement has to follow the workflow, not just the login.

Practical implication: Security teams need to govern AI at the point of action, not only at sign-in.

Why data movement through GenAI SaaS is the real exposure signal

The most important signal in this report is not adoption volume alone, but the increase in data movement events into and out of GenAI SaaS. That indicates AI is becoming a data transit layer, not just a productivity layer. For identity and data governance, that means the relevant question is whether content controls, classification rules, and access boundaries are enforced as data leaves controlled systems and enters AI services. Without that, organisations can have nominally approved AI usage while still expanding the exfiltration surface.

Practical implication: Tie AI usage governance to data-loss and entitlement controls at the transfer point.

How workflow sprawl creates unmanaged AI access paths

As agentic apps spread, the risk is not only shadow use of a single tool, but fragmentation across many endpoint workflows. Each app, extension, or desktop agent can create its own access pattern, its own data flow, and its own privilege assumptions. That is why tool sprawl becomes a governance problem: identity teams cannot manage what they cannot inventory, and security teams cannot protect what they only see after data has moved. The article’s trend line suggests this is now a scaling issue, not an edge case.

Practical implication: Build inventory and policy coverage for endpoint AI tools before adoption outpaces visibility.

NHI Mgmt Group analysis

Agentic endpoint adoption creates a data governance problem before it creates a model risk problem. The report’s core shift is not simply that AI usage is rising, but that the endpoint is becoming the primary place where AI touches sensitive content and workflow context. That moves the governance burden from prompt controls to data-path controls, which is where IAM, DLP, and SaaS access governance must converge. Practitioners should treat endpoint AI as an access architecture issue, not a software preference question.

Data movement into and out of GenAI services is the better risk indicator than usage counts alone. Adoption figures show reach, but movement figures show exposure. A programme can tolerate experimentation and still fail if sensitive data can cross into AI tools without classification, entitlement, or retention controls. The control gap is not AI presence itself, but the absence of policy at the transfer boundary. Practitioners should anchor governance on data flow observability, not app popularity.

Endpoint AI sprawl is a new form of shadow workflow risk. The named concept here is endpoint AI path sprawl, meaning multiple desktop agents, assistants, and embedded AI tools each create their own unmanaged route for data and action. That is materially different from a single sanctioned SaaS integration because the attack and governance surface is distributed across user devices. Practitioners should assume the next governance failure will come from a workflow they did not map.

Identity teams need to extend governance to machine-initiated actions inside user sessions. When AI tools can trigger actions on behalf of a worker, the session contains both human intent and machine execution. That complicates approval models, audit trails, and least-privilege assumptions because the thing performing the action is no longer only the employee. Practitioners should demand visibility into which agent executed which step, under which entitlement, and against which data set.

This is where AI governance and identity governance overlap in a practical way. NIST AI RMF addresses risk management for AI systems, but the operational controls here sit in identity, endpoint, and data governance. The organisation that treats AI adoption as a purely procurement-led issue will miss the access, exfiltration, and workflow layers where actual exposure accumulates. Practitioners should align AI policy with entitlement review and data-access monitoring, not leave it in a separate governance silo.

From our research library:

• Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
• Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

Endpoint AI path sprawl: organisations need a governance view of every desktop agent, extension, and embedded assistant that can move data or trigger actions on a user’s behalf. The first failure mode will be unmanaged workflow creation, not model compromise, so inventory and policy enforcement need to start at the endpoint.

AI risk management and identity governance now overlap at the transfer boundary. NIST AI RMF is relevant for programme design, but the operational choke point is still entitlement, classification, and audit control over the data that enters and exits AI services. Practitioners should align AI policy with access governance rather than leaving it as a separate committee topic.

For practitioners

• Inventory endpoint AI tools and desktop agents Catalogue browser extensions, desktop assistants, and embedded AI apps that can move or transform data on user endpoints. Track them as part of your access and data-exposure surface, not as informal productivity software.
• Bind AI usage to data-classification policy Apply handling rules at the point where content enters GenAI SaaS or an agentic app, including restrictions on regulated, confidential, and source-code data. The control objective is to stop uncontrolled data transit, not merely approve the application.
• Review human and machine action boundaries Define which steps an agent may execute inside a user session, which require human confirmation, and which must be blocked entirely. Capture the resulting actions in logs that preserve who approved the workflow and what the agent actually did.
• Measure AI workflow sprawl by data movement Track how often data enters and exits AI services, which teams use which tools, and whether those tools are sanctioned. Use the trend in data movement events as an exposure metric rather than relying on adoption counts alone.
• Add endpoint AI to incident response playbooks Prepare response steps for exposed prompts, copied source files, and unauthorized agent actions on the endpoint. Tie containment to session revocation, tool disablement, and review of downstream data destinations.

Key takeaways

• AI adoption is shifting the security problem from chat interfaces to endpoint workflows that can move data and trigger actions.
• The strongest exposure signal is not usage alone but how much information is entering and leaving AI services.
• Governance needs to cover inventory, policy enforcement, and auditability for agentic tools before they become normalised across the desktop.

Key terms

• Agentic Endpoint Security: A governance model for AI tools that act on endpoints with enough authority to access data, run commands, or trigger workflow changes. The focus is not just endpoint detection but runtime scope, identity context, and revocation when the task or session ends.
• Data movement event: A data movement event is any user action that transfers information from one controlled context to another, such as pasting text or uploading a file. In Shadow AI scenarios, treating these actions as governed events helps security teams connect identity, content, and policy.
• Endpoint AI Path Sprawl: The growth of multiple AI tools, assistants, extensions, and desktop agents across user devices, each creating its own route for data and action. It describes the governance problem created when organisations cannot inventory or consistently control all of those paths.
• Workflow Risk: The security risk that arises when an application can initiate or continue actions across a business process, not just process a single request. In agentic environments, workflow risk matters because the harm often comes from what the tool does after access is granted, not from the initial prompt.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and machine identity security. It helps practitioners connect identity controls to the broader access and governance decisions that shape modern AI risk.