Topic starter
02/08/2026 11:47 am
TL;DR: Enterprise AI adoption now spans an average of 54 genAI applications, endpoint AI agent adoption grew 276% in 2025, and 39.7% of sensitive data interactions with AI tools involve data employees should not be sharing, according to Cyberhaven research. The control problem is not policy awareness but enforcement across data flow, agent behaviour, and model exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Cyberhaven: “Enterprise AI Security Use Cases: What Security Teams Are Solving For”.
By the numbers:
- The average organisation now uses 54 generative AI applications, according to Cyberhaven.
- Endpoint AI agent adoption grew 276% in 2025, according to Cyberhaven.
- 39.7% of sensitive data interactions with AI tools involve data employees should not be sharing, according to Cyberhaven.
Key questions
Q: What happens when sensitive data is entered into a public AI tool without strong controls?
A: Sensitive data can be exposed beyond the organisation’s intended boundary, creating risk of identity theft, fraud, reputational damage, and legal liability.
Q: Why do AI agents create more governance risk than ordinary integrations?
A: AI agents can connect quickly, run continuously, and accumulate broad permissions across multiple services.
Q: How can organisations tell whether an AI coding model is safe enough to use?
A: Use model-specific measures rather than generic vendor claims.
Practitioner guidance
- Map AI data flows to sensitive classifications Track what data enters genAI tools, where it originates, and whether it should be allowed in browser-based sessions at all.
- Scope agent permissions to task-level need Treat agents as privileged execution paths and restrict access to only the systems and data categories required for the workflow.
- Instrument model pipelines for provenance Record what data is used in fine-tuning, retrieval, and internal model development so exposed inputs can be traced before deployment.
Bottom line: Enterprise AI security breaks down when organisations can see AI usage but cannot enforce controls over the data entering tools, the actions agents take, or the inputs feeding models.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:58 pm
Enterprise AI governance has become a control problem, not an awareness problem. Most organisations already have acceptable use language, but policies do not stop pasted contracts, source code, or regulated data from entering AI systems. The gap is enforcement across the data path, which means security teams must treat AI sessions as governed data movement, not informal productivity activity. The practitioner conclusion is simple: if the control cannot see the data flow, the policy cannot hold.
A few things that frame the scale:
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
- Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should security teams do first when shadow AI tools appear in a client environment?
A: The first step is to identify where unauthorized tools are actually being used. Regular IT audits and application discovery help teams locate unsanctioned AI services, assess what data is being shared, and decide whether to block, replace, or formally approve each application. Without visibility, policy enforcement becomes guesswork and the client cannot control data flow.
👉 Read our full editorial: Enterprise AI security use cases are really data and agent control gaps