Topic starter
25/06/2026 1:13 am
TL;DR: AI shifted in six months from heavily restricted use to active business demand, while security teams struggled to keep pace with shadow AI, data exposure, and policy gaps, according to WitnessAI. The real issue is not adoption itself, but the assumption that existing governance can absorb AI without new visibility, guardrails, and oversight.
Editorial analysis by NHI Mgmt Group, based on content published by WitnessAI: “From Prohibition to Proliferation: How Business Demand for AI Is Forcing Security to Say ‘Yes’”.
By the numbers:
- WitnessAI spoke with more than 200 organisations across various industries about AI adoption and security controls.
Key questions
Q: How should security teams govern shadow AI without blocking business productivity?
A: Start by identifying the identities and credentials behind AI use, then classify each one by data sensitivity, connected systems, and business purpose.
Q: Why do sanctioned AI assistants create data exposure risk in collaboration platforms?
A: Sanctioned AI assistants inherit the permissions of the repositories they query, so any over-shared file or loosely governed workspace can become visible through the assistant interface.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Practitioner guidance
- Discover shadow AI before enforcing policy Inventory sanctioned and unsanctioned AI tools, then map which repositories, chat systems, and code assets they can reach.
- Classify AI use by business intent Separate customer support, developer assistance, and internal search into different policy scopes so one control set does not overfit all use cases.
- Restrict data exposure at retrieval time Block or anonymise regulated values before AI systems can retrieve or display them, including customer records and payment data.
Bottom line: AI adoption is moving into production faster than many security teams can see or govern it, which turns shadow AI into an access and oversight problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:28 am
Shadow AI is now a governance discovery problem, not just an acceptable-use issue: when business units adopt AI faster than the security team can inventory it, the first failure is visibility. Policy does not govern what it cannot see, and that makes unmanaged AI a lifecycle and access problem as much as a technology problem. Practitioners need to treat discovery as the entry point to AI governance.
A few things that frame the scale:
- Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should organisations do when AI adoption outpaces governance?
A: Slow the rollout of new use cases until the identity model is clear, the permissions are bounded, and the lifecycle process is in place. Security leaders should fund AI only where it supports existing cybersecurity objectives and where access can be monitored, rotated, and removed on time.
👉 Read our full editorial: AI adoption is outpacing security controls in enterprise environments