GenAI governance fails when teams skip the business case

At a glance

What this is: This CIO perspective argues that GenAI programs fail when leaders start with tooling instead of purpose, governance, and adoption planning.

Why it matters: For IAM, NHI, and security teams, the message is that AI governance needs clear use-case scope, access control, and lifecycle discipline before broad rollout.

By the numbers:

• At least 30% of GenAI projects will be abandoned after proof of concept by the end of 2025, due to poor data quality, inadequate risk controls, escalating costs or unclear business value.
• Managers in the study’s top quartile spent 229% more time experimenting with and using GenAI in one month than managers in the bottom 25%.
• Employees who report that their managers care about them have a 14% higher GenAI usage rate.
• Study participants who believe they need GenAI for their work reported 66% higher GenAI usage than those who did not.

👉 Read CyberArk’s perspective on why GenAI programmes need a clear business purpose

Context

GenAI programs often fail because organizations treat model deployment as the goal instead of a governed business change. In practice, the hardest problems are not only technical performance but also access scope, data quality, operational adoption, and whether the program can justify its own cost and risk in IAM and NHI-heavy environments.

This article frames that problem as a leadership discipline issue: start with why, then decide whether AI, automation, or a different control pattern is the right fit. That perspective is typical of organizations trying to scale GenAI responsibly, but it still leaves practitioners responsible for the identity, data, and authorization controls that make scale safe.

Key questions

Q: How should organisations govern GenAI before broad rollout?

A: They should define the business purpose, assign an accountable owner, and connect the program to explicit data, access, and logging controls before scale. A pilot should not graduate until the team can show who can use it, what data it can reach, and how exceptions are reviewed. That sequence reduces avoidable technical and identity debt.

Q: Why does GenAI adoption increase security risk as usage grows?

A: Because adoption expands the control surface. More users, more prompts, more data sources, and more downstream actions create more opportunities for overbroad permissions, poor logging, and shadow AI. Security teams need entitlement review and monitoring to keep growth from turning into unmanaged access.

Q: What is the difference between AI experimentation and governed AI deployment?

A: Experimentation is narrow, supervised, and often supported by manual controls. Governed deployment has documented purpose, approved data sources, defined access boundaries, logging, and a clear owner. The difference is not model quality. It is whether the organisation can explain and audit how the system uses data and permissions.

Q: When should teams stop a GenAI rollout and reassess?

A: They should stop when the use case cannot prove value, when data quality is weak, or when access cannot be tied to a specific business need. Those are signs that the programme is scaling confusion rather than capability. Reassessment is cheaper than expanding an unsafe pattern.

Technical breakdown

Why GenAI programs stall after proof of concept

A GenAI pilot often looks successful because it is narrow, supervised, and protected by manual workarounds. Once the use case expands, the hidden dependencies become visible: data quality, authorization boundaries, logging, approval flows, and whether the model is allowed to act or only to recommend. In security terms, the problem is not just model accuracy. It is operational trust. If the system touches sensitive data or triggers downstream actions, the organization needs identity controls, auditable policy, and a clear ownership model before scale begins.

Practical implication: Treat proof-of-concept success as a control design checkpoint, not a release decision.

How user adoption changes the risk model

Adoption is not only a change-management metric. It is also a proxy for how quickly a new system becomes part of the enterprise control surface. Low adoption can reduce immediate risk, but it also creates pressure to expand features without enough operational discipline. High adoption, especially across many business groups, increases the volume of data touched, the number of users who can approve or prompt actions, and the chance that unmanaged accounts or AI assistants become shadow AI. That makes access review, role scoping, and monitoring essential early, not after scale.

Practical implication: Align rollout phases with entitlement reviews and monitoring thresholds.

Data governance and authorization are the real guardrails

The article’s “capture, classify and clean” guidance is a data-management rule, but the security translation is straightforward: AI output quality depends on the sensitivity, completeness, and access control of the underlying data. If training or retrieval sources include stale, overbroad, or poorly classified content, the system can surface information that should never be available to the requester. For NHI and IAM teams, that means GenAI governance must connect data classification, least privilege, and auditability. Without those links, the organization is measuring usage while underestimating exposure.

Practical implication: Tie GenAI access to data classification and audit logs before expanding the deployment.

Breaches seen in the wild

• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.
• DeepSeek breach — DeepSeek breach exposed 1M+ log lines and sensitive secret keys.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Purpose-first AI governance is now an identity problem as much as a portfolio problem. The article is right to challenge teams that start with tools, but the operational consequence is broader than technology selection. Once AI systems can reach internal content, workflows, and downstream systems, the question becomes who or what is allowed to act, under what conditions, and with what audit trail. Practitioners should treat AI program purpose as the first control decision, not the last business slide.

GenAI adoption becomes a control-surface expansion, not just a usage metric. Higher uptake increases the number of identities, permissions, and data paths that must be governed. That is especially true when employees, managers, bots, and embedded assistants all interact with the same content sources. The practical takeaway is that growth planning should include entitlement review, logging, and exception handling before usage spikes.

Capture, classify and clean is a governance concept, but it also defines the trust boundary for NHI and AI agents. Data that is poorly classified or weakly governed will leak into prompts, retrieval, and automated actions. That creates an access problem as much as a data quality problem. Teams should connect classification, authorization, and policy enforcement so that AI programs do not inherit uncontrolled access.

Manager sponsorship matters because it determines whether AI stays a controlled pilot or becomes informal shadow AI. When leaders normalize ad hoc experimentation without guardrails, employees often create local workarounds and untracked use cases. That pattern complicates auditability and makes identity governance harder. Security teams should use leadership momentum to formalize standards, not to bypass them.

Impactful AI programs need measurable business value, but governance should define the measurement model from the start. If teams cannot show what the system is supposed to improve, they will eventually over-collect data, over-grant access, and overextend controls in search of value. The discipline is to define purpose, risk, and access together. Practitioners should insist that every AI initiative map to a bounded use case and a documented control set.

From our research:

• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities , 46% confirmed, 26% suspected, according to The 2024 ESG Report: Managing Non-Human Identities.
• Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, according to The 2024 ESG Report: Managing Non-Human Identities.
• For a deeper NHI control baseline, review Top 10 NHI Issues alongside AI program governance to map identity exposure before scaling automation.

What this signals

GenAI programmes will increasingly be judged on whether they can prove control, not just adoption. The next phase of enterprise AI governance will move from pilot enthusiasm to evidence of accountable access, auditable data paths, and clear owners. For IAM and NHI teams, that means enterprise AI should be treated as a governed identity consumer, not a standalone innovation track.

Shadow AI is likely to emerge wherever teams confuse productivity experiments with sanctioned deployments. The practical warning is that unmanaged assistants and service identities can spread faster than governance processes if rollout is driven by informal manager enthusiasm. Organisations should use the current AI wave to tighten access review, logging, and ownership rather than rely on policy statements alone.

With 96% of technology professionals identifying AI agents as a growing security threat, the governance gap is no longer theoretical. AI initiatives that touch data or trigger actions need the same scrutiny applied to other high-risk NHIs, including least privilege, lifecycle review, and exception tracking.

For practitioners

• Define the business purpose before the build Document the specific workflow, decision, or task the GenAI program is meant to improve, then reject use cases that do not have a clear success metric and owner. This prevents scope creep and makes access decisions easier to justify.
• Bind AI access to data classification Require that retrieval sources, training inputs, and connected systems be tagged and reviewed before the AI program can use them. If the data cannot be classified, do not let the model access it.
• Phase rollout with entitlement reviews Start with one use case and one user group, then expand only after reviewing permissions, audit logging, and exception handling. Reassess whether accounts, service identities, and assistants still need the same access at each phase.
• Measure adoption alongside risk Track who is using the system, what data it touches, and whether usage is creating new unmanaged identities or shadow AI patterns. Adoption metrics without control metrics will overstate readiness.

Key takeaways

• GenAI programmes fail most often when teams treat deployment as the finish line instead of defining a governed business purpose.
• Adoption, manager sponsorship, and enablement improve outcomes, but they also expand the identity and data control surface.
• Security teams should tie AI rollout to data classification, access review, and auditability before broadening usage.

Key terms

• Shadow AI: Undiscovered or unmanaged AI systems, assistants, or automations used inside an organisation without formal approval. In practice, shadow AI becomes an identity governance problem because the system may access sensitive data, act on behalf of users, or create unreviewed non-human identities.
• GenAI Governance: The set of policies, controls, and accountability rules that determine how generative AI is approved, used, monitored, and retired. Effective governance connects purpose, data classification, access boundaries, logging, and ownership so AI programs do not scale faster than control maturity.
• Control Surface: The full set of identities, permissions, data paths, and operational points that security teams must supervise. For AI programmes, the control surface expands quickly because users, service accounts, bots, and downstream tools can all become part of the trusted execution chain.

Deepen your knowledge

GenAI governance, access boundaries, and data control are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building an AI programme with similar identity and authorization challenges, it is worth exploring.

This post draws on content published by CyberArk: CIO POV on why impactful AI programmes start with “why.” Read the original.