Topic starter
25/06/2026 1:09 am
TL;DR: Enterprises cannot secure generative AI with browser-only visibility or keyword-based DLP because shadow AI now sits in desktop apps, IDEs, and fragmented toolchains, according to WitnessAI. The real governance shift is from blocking usage to understanding intent, routing risk appropriately, and building controls that scale across global enterprise environments.
Editorial analysis by NHI Mgmt Group, based on content published by WitnessAI: “Deploying AI in the Enterprise? Key Considerations for Security Leaders”.
Key questions
Q: How should security teams govern Shadow AI in everyday browser use?
A: Security teams should govern Shadow AI by enforcing controls where users actually interact with AI tools, not only at the network edge.
Q: Why do keyword-based DLP controls fail for generative AI use?
A: Keyword-based DLP fails because it can only inspect content patterns, not user intent or business context.
Q: What are the signs that AI governance is too fragmented to support scale?
A: Common signs include duplicated governance tools, inconsistent policies across business units, and teams managing AI or data controls in isolation.
Practitioner guidance
- Map AI usage beyond the browser Discover AI activity in desktop assistants, IDE integrations, command lines, and other non-web workflows so policy covers the full interaction surface.
- Classify prompts by intent and sensitivity Separate software development, legal research, data analysis, and other business purposes so enforcement decisions follow context, not just keywords.
- Treat routing as a governed control plane Define which prompts must go to private models, which can go to public models, and which must be blocked based on risk and residency requirements.
Bottom line: Enterprise AI risk is driven as much by where people use AI as by which model they use.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:23 am
Browser visibility is now an incomplete governance assumption for enterprise AI. Security programmes that treat the browser as the primary control point are already behind the way employees actually use generative AI. Native desktop assistants, IDE plugins, and other non-web interactions move sensitive prompts outside legacy inspection paths. The practitioner conclusion is simple: if the control surface is wrong, the policy model will be wrong too.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do organisations balance AI data use with privacy and compliance requirements?
A: Organisations should tie AI data use to explicit governance. That means defining which datasets are allowed for AI, applying native data controls, reviewing third party risk where AI services are involved, and reassessing exposure as models or workflows change. The practical objective is to support innovation without expanding access to personal or regulated data beyond what is necessary.
👉 Read our full editorial: Enterprise AI security needs visibility, intent, and dynamic controls