Topic starter
02/08/2026 11:54 am
TL;DR: AI use is spreading across GenAI SaaS, endpoint AI applications, and AI agents while oversight remains fragmented, according to Cyberhaven’s 2026 AI Adoption & Risk Report for professional services. Its companion blog notes Claude Desktop usage grew 1,233% in six months alongside an 80% rise in GenAI SaaS data movement, and the governance gap is now a data exposure problem, not a future planning issue.
Editorial analysis by NHI Mgmt Group, based on content published by Cyberhaven: “Cyberhaven 2026 AI Adoption & Risk Report: Professional Services”.
Key questions
Q: What breaks when AI adoption outpaces governance?
A: What breaks first is attribution.
Q: Why does fragmented AI infrastructure create security risk?
A: Fragmented AI infrastructure creates risk because each provider handoff can split responsibility for credentials, permissions, and logging.
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.
Practitioner guidance
- Map all AI usage paths Inventory sanctioned GenAI SaaS, endpoint AI applications, personal accounts and agent workflows so governance reflects real usage rather than approved-tool assumptions.
- Bind AI access to identity and lifecycle controls Define ownership, approval, privilege scope and offboarding for human users, service accounts and AI agents that touch sensitive work data.
- Control sensitive data at prompt and handoff points Apply data handling rules where content is entered into AI systems, transformed by them or passed into downstream tasks, not only where it is stored.
Bottom line: Professional services AI adoption is spreading across multiple tool types and access paths faster than governance can consistently track.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:02 pm
AI adoption governance is now a control-plane problem, not a policy problem. Once employees distribute AI usage across SaaS apps, endpoint tools and unmanaged environments, the enterprise loses the ability to enforce a single governance model. That breaks the assumption that one approved catalog or one identity boundary can describe actual AI use. Practitioners should treat governance as an operating-state issue, not a document-review exercise.
A few things that frame the scale:
- Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should organizations approach the governance of AI agents?
A: Organizations should adopt a governance framework that incorporates continuous visibility, adaptive IAM practices, and stringent policy-based controls. This ensures that all agent actions are tracked, authorized appropriately, and assessed for compliance.
👉 Read our full editorial: AI adoption is outpacing governance in professional services