Topic starter
04/06/2026 3:00 pm
TL;DR: Enterprise AI use is expanding faster than organisations can prove business value, while governance friction, shadow AI, and weak measurement keep pilots from scaling, according to WitnessAI. The underlying problem is that legacy approval and audit models were built for deterministic software, not for runtime AI activity that needs continuous control and evidence.
Editorial analysis by NHI Mgmt Group, based on content published by WitnessAI: “The AI adoption-impact gap: why 88% of companies can’t prove value”.
Key questions
Q: How should security teams govern AI use in developer tooling?
A: Security teams should govern AI use as a data and access problem, not only a productivity feature.
Q: Why do organisations struggle to prove ROI from enterprise AI?
A: They often lack telemetry that links prompts, models, workflows, and decisions to measurable business outcomes.
Q: What breaks when organisations cannot see shadow AI usage?
A: When shadow AI is invisible, security teams lose control over where data is sent, which assistants are connected, and whether those systems can retain or expose sensitive information.
Practitioner guidance
- Define runtime AI governance as an operational control Treat AI usage as something to be observed and enforced during the interaction, not only approved in advance.
- Inventory AI activity across all execution paths Expand discovery beyond browser traffic to cover native applications, IDEs, embedded copilots, and autonomous agents making API calls.
- Separate policy approval from enforcement evidence Keep the policy statement, the enforcement action, and the audit trail distinct so the organisation can prove controls worked rather than only showing that rules exist.
Bottom line: Enterprise AI is creating a governance gap because usage is rising faster than organisations can observe, control, and audit it.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
04/06/2026 3:13 pm
AI governance now fails at the point of interaction, not at the point of policy: The article shows that organisations can write policies faster than they can prove those policies affect real AI usage. That matters because runtime AI activity is where data exposure, policy violation, and value creation all happen together. The implication is that governance must be measured where the interaction occurs, not where the approval form is filed.
A few things that frame the scale:
- Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How can organisations tell whether AI governance is actually working?
A: Organisations can tell AI governance is working when they can inventory every agent, explain its purpose, show who owns it, and prove that permissions are tightly scoped. If those four things are missing, the programme has policy language but not operational control. Auditors will notice the gap quickly.
👉 Read our full editorial: AI adoption is outrunning governance and measurable business value