Measuring AI ROI now depends on governance, visibility, and risk

At a glance

What this is: This is an analysis of how AI ROI measurement is changing, with the central finding that boards now expect defensible links between AI spend, business outcomes, and risk control.

Why it matters: For IAM and governance teams, the article matters because AI value is increasingly inseparable from visibility, accountability, and controls across sanctioned use, Shadow AI, and agentic deployments.

By the numbers:

• Only 31% of C-suite leaders expect to measure AI ROI within six months.

Context

AI ROI is no longer a simple question of whether a pilot saved time or reduced cost. The governance gap appears when organisations cannot show how AI spend connects to production performance, workforce impact, and risk reduction across the full investment perimeter.

That gap matters because weak measurement and weak governance fail together. Pilots stall, Shadow AI expands outside formal ownership, and boards lose confidence in claims that AI is creating durable value rather than accumulating hidden cost.

Key questions

Q: How should organisations measure AI ROI when Shadow AI is present?

A: Start by treating unknown AI use as part of the cost and risk denominator, not as an edge case. Inventory sanctioned tools, shadow applications, and agentic workloads, then measure discovery coverage, ownership, and business impact together. If usage is hidden, ROI will look artificially strong until the first control failure or audit challenge.

Q: Why do AI projects often fail to show measurable business value?

A: AI projects often fail because measurement is an afterthought. Many organisations can report spend and pilot counts, but not which interactions changed outcomes or reduced cycle time. Without telemetry at the prompt, model, and workflow level, leaders get anecdotes instead of defensible ROI evidence.

Q: What are the signs that an AI initiative is not delivering real ROI?

A: An AI initiative is usually underperforming when it takes too long to reach value, produces limited productivity gains, and fails to improve customer satisfaction or innovation speed. Another warning sign is that risk reduction never materialises, especially in fraud detection, compliance, or security use cases. If the programme cannot show measurable business outcomes, it is likely overpromising and underdelivering.

Q: Should organisations prioritise visibility or controls first in AI ROI programmes?

A: Visibility should come first because controls cannot govern what the organisation cannot see. A reliable inventory reveals sanctioned tools, Shadow AI, agents, and system connections, which then allows policy, accountability, and outcome tracking to work. Once the environment is visible, controls can be linked to financial and operational results instead of operating as isolated compliance tasks.

Technical breakdown

Why AI ROI breaks at the pilot stage

AI programs often fail to scale because the organisation measures activity instead of outcomes. A pilot may look successful in isolation, but without a complete investment perimeter, a baseline, and named owners, the programme cannot show whether it improved performance or simply added cost. The article’s point is that the problem is rarely model capability. It is governance maturity, incomplete visibility, and the inability to connect use cases to business outcomes that a board will accept.

Practical implication: define the full AI investment perimeter before treating any pilot result as ROI.

How Shadow AI distorts measurement and risk

Shadow AI is unmanaged AI use that sits outside normal inventory, policy, and approval paths. That matters because unseen tools distort both the numerator and the denominator of ROI. Hidden subscriptions, unmanaged agents, and off-book usage inflate spend while also creating exposure that shows up later as incidents, audit friction, or breach cost. The result is not just poor visibility. It is a measurement system that cannot distinguish productive use from leakage, which makes financial reporting and risk reporting inconsistent.

Practical implication: build an inventory that includes sanctioned AI, Shadow AI, agents, and integrations before reporting value.

Why governance controls belong in the ROI calculation

Governance is not an overhead line when it directly enables production use and reduces loss. Audit trails, policy enforcement, and runtime guardrails can shorten time to value, reduce blocked deployments, and avoid incidents that would otherwise erase projected returns. That is why the article treats risk controls as part of the ROI numerator when they protect value or accelerate production. For identity teams, the deeper lesson is that measurement, access control, and approval logic now form one operating system for AI value.

Practical implication: tie each governance control to a measurable business outcome rather than treating it as a separate compliance cost.

Breaches seen in the wild

• Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI ROI has become a governance test, not a finance exercise. Boards are no longer asking whether AI exists in the enterprise; they are asking whether AI investment can be defended in terms they recognise. That changes the burden of proof from enthusiasm to evidence, and it forces programme owners to show value, control, and accountability in the same narrative. Practitioners should treat ROI as a governance discipline with financial consequences, not a retrospective spreadsheet.

Shadow AI creates an identity problem before it becomes a budget problem. Unmanaged AI use expands the number of systems, agents, and integrations that operate outside inventory and ownership. Once that happens, the organisation cannot reliably attribute spend, risk, or responsibility. The result is a broken control plane for AI use, where value leaks and exposure accumulates in parallel. Practitioners should prioritise governable visibility before they prioritise another dashboard.

Agentic AI makes ROI depend on pre-execution control, not post-hoc explanation. When systems can initiate actions, route through tools, and operate beyond a single static workflow, the old assumption that value can be measured after deployment weakens. The relevant question becomes whether the enterprise can attribute actions, enforce policy, and bound risk before the work is done. Practitioners should assume that autonomous-style AI raises the cost of ambiguity and lowers the usefulness of after-the-fact reporting.

Defensible AI spending now requires a named concept: governance-as-ROI infrastructure. The article shows that audit trails, policy enforcement, inventory coverage, and runtime guardrails are not adjacent support functions. They are part of the mechanism that allows AI spend to become provable value. That framing matters because it turns governance from a cost centre into the measurement substrate for the programme. Practitioners should design AI oversight as part of ROI architecture, not as a separate review step.

Measuring AI ROI without risk-adjusted metrics produces fragile confidence. Financial metrics alone can make a programme look healthy while hidden exposure grows underneath it. The article’s emphasis on breach cost, compliance posture, and inventory coverage reflects a broader reality: AI returns only remain real if they survive scrutiny from auditors, regulators, and incident response. Practitioners should report ROI with leading indicators that show whether the value story will still hold next quarter.

From our research library:

• A Harris Poll survey of more than 300 technology decision-makers found that 86% expect agentic AI to deliver positive ROI, yet fewer than half had AI governance policies in place.

What this signals

Governed visibility is now the base layer for AI value. When AI activity is inventoried across employees, apps, agents, and connections, finance and security teams can finally discuss the same environment. That reduces disputes over what is in scope and shifts the conversation from anecdotal productivity claims to measurable programme outcomes.

Shadow AI detection is a measurement control, not just a security control. Unknown AI use can inflate spend, obscure ownership, and create incident cost that wipes out expected returns. The practical lesson for programme owners is that discovery and classification are prerequisites for a credible ROI narrative, especially where governance evidence must survive audit and board challenge.

For practitioners

• Define the full AI investment perimeter Include model licences, API consumption, infrastructure, vendor contracts, integration work, change management, training, governance tooling, and hidden Shadow AI costs in the denominator.
• Build one AI inventory for all use patterns Record sanctioned applications, Shadow AI, agentic deployments, and MCP server connections in a single register and assign an executive owner to each entry.
• Choose a small board-ready metric set Track a limited mix of revenue, efficiency, time-to-value, and employee adoption metrics, with each one owned, baselined, and tied to a reporting cadence.
• Add risk-adjusted measures to the scorecard Report Shadow AI detection gap, inventory coverage, compliance posture, and potential breach-cost exposure alongside financial ROI so the board sees value and fragility together.
• Map governance controls to business outcomes Show how audit trails, policy enforcement, approved-model routing, and runtime guardrails reduce loss or accelerate production, then express that effect in dollar terms.

Key takeaways

• AI ROI fails when organisations treat usage as value and ignore whether spend is tied to governed business outcomes.
• Shadow AI and pilot purgatory are the two recurring patterns that drain return before a programme reaches steady-state production.
• The strongest ROI programmes connect visibility, control, and ownership to metrics that boards can defend and auditors can test.

Key terms

• AI ROI Perimeter: The full set of AI costs that should be counted when measuring return, including licences, infrastructure, integration, training, governance tooling, and hidden Shadow AI spend. In practice, the perimeter defines whether ROI is a real calculation or a selectively framed story.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• AI Inventory: An AI inventory is a governed record of all AI-related assets, enriched with owner, purpose, access, and risk context. It turns discovery into something security, compliance, and IAM teams can use to make approval, review, and revocation decisions.
• Risk-adjusted ROI: Risk-adjusted ROI measures return after factoring in loss exposure, compliance friction, and control effectiveness. It is more useful than simple savings calculations because it shows whether AI gains are durable, defensible, and likely to survive operational or regulatory scrutiny.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.