Notifications
Clear all
Topic starter
04/06/2026 6:47 pm
TL;DR: Enterprise AI ROI is hardest to prove when leaders measure pilots, not production, and when security, finance and engineering each track different outcomes; WitnessAI frames the problem as defensive, efficiency and productivity returns, with 39% of organizations reporting enterprise-level EBIT impact from AI. The real issue is that AI value is only defensible when governance, visibility and baselining make the returns measurable in production.
NHIMG editorial — based on content published by WitnessAI: AI ROI is the measure of whether enterprise AI investments are creating business value that leaders can defend
By the numbers:
- Only 39% of organizations report an enterprise-level EBIT impact from AI.
- 30% of projects were abandoned by 2025 due to poor data quality, inadequate risk controls, escalating costs, and unclear business value.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected.
Questions worth separating out
Q: How should organisations calculate AI ROI across security, finance and productivity goals?
A: Start with three separate baselines: defensive ROI for avoided loss, efficiency ROI for reclaimed spend, and productivity ROI for shipped outcomes.
Q: Why do AI ROI models often fail after a successful pilot?
A: Pilots usually measure activity, not production durability.
Q: How can security teams prove defensive ROI from AI governance?
A: By linking AI activity to visible outcomes such as reduced breach exposure, lower compliance overhead and less Shadow AI usage.
Practitioner guidance
- Build a three-part ROI model Map defensive ROI to security and compliance, efficiency ROI to finance and IT operations, and productivity ROI to engineering and business leaders.
- Instrument AI usage with identity-aware telemetry Capture who used which model or agent, what data was involved, and whether the request was allowed, warned, blocked or routed.
- Treat Shadow AI as both a governance and cost problem Inventory unsanctioned AI tools, duplicate subscriptions, and unmanaged personal usage so hidden spend and hidden exposure are measured together.
What's in the full article
WitnessAI's full article covers the operational detail this post intentionally leaves for the source:
- The breakdown of how WitnessAI's runtime controls map to specific AI ROI dimensions in production.
- The article's own examples of how audit trails, routing and intent classification support finance and security reporting.
- The platform-specific explanation of bidirectional runtime defense and how its control model supports AI governance workflows.
- The detailed product-level discussion of discovery, routing and policy enforcement that implementation teams would use after the strategy phase.
👉 Read WitnessAI's full AI ROI framework for defensive, efficiency and productivity returns →
AI ROI and governance: are your controls tied to real outcomes?
Explore further
04/06/2026 6:59 pm
AI ROI is now an identity governance problem as much as a finance problem. Once AI is embedded in employee workflows, developer tools and agentic systems, the question is no longer whether adoption happened but whether it can be governed well enough to survive production. That makes visibility, attribution and policy enforcement part of the return calculation, not just security plumbing. Practitioners should treat ROI measurement as an access and control discipline, not a post-hoc spreadsheet exercise.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected, according to The 2024 ESG Report: Managing Non-Human Identities.
- Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, which shows how quickly one exposure can become a repeat problem.
A question worth separating out:
Q: What should leaders do when AI usage is spreading faster than governance can see it?
A: Prioritise visibility first, then classification and policy enforcement. Hidden AI use creates both unmanaged spend and unmanaged risk, so the first control objective is to discover where AI is being used, by whom, and with what data. Once that is clear, finance and security can evaluate the same usage from their own perspectives.
👉 Read our full editorial: AI ROI breaks down without governance across risk, savings and output
