Topic starter
24/06/2026 8:07 pm
TL;DR: Agentic AI governance gaps are widening as 86% of organisations lack visibility into AI data flows and 96% of enterprises now say AI agents are a security risk, according to Kong’s cited sources. The governance model is already breaking because review-based controls cannot keep pace with agent-timed access, tool use, and data movement.
Editorial analysis by NHI Mgmt Group, based on content published by Kong: “# Agentic AI Governance: Managing Shadow AI and Risk for Competitive Advantage”.
By the numbers:
- 86% of organisations have no visibility into their AI data flows.
- 96% of enterprises acknowledge that AI agents are a security risk.
- 20% of security breaches are now classified as shadow AI incidents.
Key questions
Q: What breaks when agentic AI is scaled before governance is mature?
A: What breaks first is accountability.
A: AI agents and shadow AI often bypass normal procurement and review, so a static inventory can miss who owns them, what they connect to, and what data they can reach.
Q: How can organisations tell whether AI governance is actually working?
A: Organisations can tell AI governance is working when they can inventory every agent, explain its purpose, show who owns it, and prove that permissions are tightly scoped.
Practitioner guidance
- Map every AI data path Document agent-to-agent, agent-to-LLM, agent-to-MCP, and MCP-to-API flows so you can see where data leaves approved boundaries and where blind spots exist.
- Move high-risk checks into policy-as-code Automate PII redaction, rate limiting, access controls, and audit logging so the enforcement point sits inside the request path rather than in a manual review queue.
- Create a single governance plane for agents Align development, platform, security, and compliance teams around one platform model so observability, authorization, and cost controls operate against the same transaction record.
Bottom line: Shadow AI turns AI adoption into a governance problem because data movement, tool use, and decision-making no longer stay inside predictable control boundaries.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:17 am
Agentic AI governance is no longer a supporting control. It is becoming the control that determines whether AI deployment remains governable at all. When agents can choose tools, move data, and trigger downstream actions faster than review cycles, the governance model, not the model itself, becomes the security boundary.
A few things that frame the scale:
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between shadow IT and shadow AI?
A: Shadow IT is the use of unapproved software, while shadow AI is the use of unapproved or unmanaged generative AI services and embedded copilots. Shadow AI is harder to govern because it often hides inside sanctioned SaaS tools and can move data into external model systems without obvious signs.
👉 Read our full editorial: Agentic AI governance is becoming the decisive security control