Topic starter
09/06/2026 11:51 pm
TL;DR: LLM adoption surged in 2023, with ChatGPT reaching over a million users in its first week, Bard drawing around 140 million monthly visitors, and Claude 2.1 expanding to a 200,000-token context window, according to Lasso Security. The governance problem is no longer model capability alone but Shadow AI, visibility, and policy design across human, machine, and emerging autonomous use cases.
Editorial analysis by NHI Mgmt Group, based on content published by Lasso Security: “Wrapping Up 2023: Anticipating LLMs & GenAI Trends in The Year Ahead”.
Key questions
Q: How should security teams govern shadow AI without blocking business productivity?
A: Start by identifying the identities and credentials behind AI use, then classify each one by data sensitivity, connected systems, and business purpose.
Q: Why does GenAI create a governance problem beyond model security?
A: Because the risk is no longer confined to the model itself.
Q: What do security teams get wrong about governing AI agents?
A: They often treat agents like another automation layer instead of governed non-human actors with their own access paths.
Practitioner guidance
- Map all GenAI usage paths Inventory employee-facing tools, application integrations, and any embedded model usage so the organisation knows where LLMs are already present.
- Separate human and application policy Write distinct policy controls for employee use, application use, and future autonomous use cases rather than relying on a single generic AI policy.
- Classify prompt and context data Identify which data classes are entering prompts, retrieval layers, and model context windows so data handling rules can be enforced consistently.
Bottom line: LLM and GenAI security has moved beyond model capability into governance, visibility, and policy enforcement across real enterprise usage.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 hours ago by NHI Mgmt Group
10/06/2026 2:23 am
Shadow AI is the first governance failure, not the last security symptom. The article’s central problem is uncontrolled GenAI adoption before policy and inventory are in place. Once users and applications start embedding LLMs into everyday work, the organisation loses line of sight into data flow, authorisation, and accountability. The practitioner conclusion is simple: if you cannot enumerate the model, you cannot govern the identity path that reaches it.
A few things that frame the scale:
- 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments, according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: Should IAM teams treat GenAI as part of access governance?
A: Yes. GenAI is part of access governance whenever it can read, transform, or disclose enterprise data, because the key question is who or what is authorised to invoke the model and under what conditions. IAM teams should define identity ownership, access scope, logging, and review for each GenAI workflow before adoption scales.
👉 Read our full editorial: LLM and GenAI security is becoming a distinct governance problem
11/06/2026 1:23 am
Shadow AI is the first governance failure, not the last security symptom. The article’s central problem is uncontrolled GenAI adoption before policy and inventory are in place. Once users and applications start embedding LLMs into everyday work, the organisation loses line of sight into data flow, authorisation, and accountability. The practitioner conclusion is simple: if you cannot enumerate the model, you cannot govern the identity path that reaches it.
A few things that frame the scale:
- 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments, according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: Should IAM teams treat GenAI as part of access governance?
A: Yes. GenAI is part of access governance whenever it can read, transform, or disclose enterprise data, because the key question is who or what is authorised to invoke the model and under what conditions. IAM teams should define identity ownership, access scope, logging, and review for each GenAI workflow before adoption scales.
👉 Read our full editorial: LLM and GenAI security is becoming a distinct governance problem
12/06/2026 2:58 am
LLM security is becoming a governance category, not a feature set. The article is right to separate AI security from generic cybersecurity because the control plane is different. The issue is not just model capability or prompt quality, but who is using the system, through what identity, and with what data authority. Practitioners should treat GenAI governance as a distinct operating discipline.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
- Generative AI use specifically increased from 33% in 2023 to 79% in 2025, according to McKinsey’s Global Surveys on the State of AI.
A question worth separating out:
Q: What is the difference between LLM security and traditional IAM governance?
A: Traditional IAM governs relatively stable access patterns, while LLM use introduces dynamic transactions, variable data exposure, and multiple actor types. The control question shifts from who can log in to what the identity is allowed to send, retrieve, and disclose through AI workflows.
👉 Read our full editorial: LLM and GenAI security is becoming a distinct governance problem
This post was modified 4 hours ago by NHI Mgmt Group