Topic starter
22/06/2026 10:23 am
TL;DR: AI use has moved into core workflows, with Nudge Security reporting that 96.0% of organizations now use OpenAI, 77.8% use Anthropic, and 17% of prompts include copy-paste or file uploads, while sensitive-data events are led by secrets and credentials at 47.9%. That makes AI governance a continuous identity and data-flow problem, not a policy exercise.
Editorial analysis by NHI Mgmt Group, based on content published by Nudge Security: “AI Adoption Research from Nudge Security Reveals How Widespread AI Use Is Transforming Security Governance”.
By the numbers:
- OpenAI is present in 96.0% of organizations, according to Nudge Security.
- Anthropic is present in 77.8% of organizations, according to Nudge Security.
- 17% of prompts include copy-paste or file upload activity, according to Nudge Security.
Key questions
Q: How should security teams govern AI-enabled workflows that can act on their own?
A: Treat them as identity-governed execution paths, not just software features.
Q: Why do one-off AI integrations create risk in identity security programmes?
A: They create many separate control paths, each with its own testing, maintenance, and logging burden.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Practitioner guidance
- Map AI tools to live access paths Inventory which AI tools are connected to productivity suites, knowledge systems, and code repositories, then document the permissions each integration can exercise.
- Classify prompt content as data movement Apply sensitivity rules to copy-paste and file upload activity inside AI tools so that secrets, credentials, and regulated data are monitored as outbound flows.
- Review delegated access behind AI integrations Check whether AI-connected services inherit broader permissions than the business use case requires, especially in chat, coding, and knowledge workflows.
Bottom line: AI adoption has crossed into operational workflows, which makes governance a live identity problem instead of a policy-only problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 11:16 am
AI governance has become an identity governance problem, not a policy problem. The article shows that AI is now embedded in workflows and connected to operational systems, which means the real control surface is who or what can act, connect, and transmit data at runtime. Policy still matters, but policy alone cannot govern live permission paths. Practitioners should treat AI usage as a governed identity state, not a static acceptable-use category.
A few things that frame the scale:
- Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
A: Continuous monitoring should come first when environments change quickly or privileged access spans multiple systems. Periodic access reviews still matter, but they are too slow to prove ongoing control in dynamic estates. The best sequence is live visibility first, then scheduled review for governance confirmation and exception handling.
👉 Read our full editorial: AI adoption is turning governance into a real-time identity problem