Notifications
Clear all
Topic starter
24/08/2026 2:00 pm
TL;DR: Enterprise AI programs often see traffic but lack the context needed to govern what employees and agents are actually doing, according to WitnessAI. The gap is that legacy controls inspect packets and files, while AI governance must evaluate identity, role, data, purpose, and regulatory context in real time.
NHIMG editorial — based on content published by WitnessAI: AI governance in business context and strategic visibility
By the numbers:
- 69% of organizations suspect or have evidence that employees use prohibited public generative AI, according to Gartner.
- In one enterprise benchmark, keyword-based approaches achieved only 40% recall on policy-violating outputs.
Questions worth separating out
Q: How should security teams govern employee AI use without blocking productivity?
A: Start with visibility into sanctioned and shadow AI use, then apply runtime policies that inspect intent and context rather than only keywords.
Q: Why do traditional DLP and data governance controls miss generative AI risk?
A: Traditional DLP and governance tools were designed mainly for data at rest, such as databases, file shares, and scheduled scans.
Q: What breaks when AI governance only monitors prompts and outputs?
A: Prompt and output monitoring misses the moment where the real risk occurs, which is execution.
Practitioner guidance
- Map AI interactions to identity and purpose Classify prompts by user role, data sensitivity, business purpose, and destination model before deciding whether the interaction can proceed.
- Replace binary enforcement with graduated policy actions Use allow, warn, block, route, and tokenization so policy can respond proportionally to the risk in each interaction.
- Extend governance to Shadow AI and embedded AI features Inventory approved tools, unofficial public models, and SaaS features with embedded AI so policy coverage matches actual usage.
What's in the full article
WitnessAI's full article covers the operational detail this post intentionally leaves for the source:
- How its network-level discovery distinguishes approved tools, Shadow AI, and embedded AI features in SaaS platforms.
- How intent-based classification and graduated enforcement are applied across allow, warn, block, route, and tokenization decisions.
- How unified audit trails are structured to support board reporting and regulatory evidence.
- How the platform extends across browser activity, native applications, and developer IDEs.
👉 Read WitnessAI's analysis of AI governance in business context →
AI governance in business context: are your controls keeping up?
Explore further
24/08/2026 2:01 pm
AI governance has shifted from application control to interaction control. Traditional security programs ask whether an application is approved. That question is too coarse for conversational AI, where risk is determined by identity, purpose, and data context at the moment of use. The practical conclusion is that governance models built for login events and file movement no longer describe the real unit of risk.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- That same research found only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, which helps explain why AI governance often starts with visibility gaps.
A question worth separating out:
Q: Who is accountable when an AI agent accesses sensitive data it was not meant to use?
A: Accountability sits with the team that approved the agent, its connectors, and its policy boundaries, not with the runtime behaviour alone. Organisations need ownership for intent, permissions, monitoring, and validation so they can prove whether the agent stayed inside its approved purpose. Without that, audit and regulatory response become retrospective guesswork.
👉 Read our full editorial: AI governance in business context exposes the real control gap
