Leadership at most companies think they have a decent handle on how AI is being used, but the latest research says otherwise. Two-thirds of office professionals at large companies admit they’ve used AI tools they at least believed were against policy, and separately, security teams surveyed by IDC couldn’t produce an accurate count of the AI agents already running in their own systems. The moral of this story up front: AI adoption inside the average company has quietly outrun the ability of IT and security teams to see it, let alone manage it.

• Employees are pasting more sensitive information into AI tools than most leaders assume. 88% of workers have shared some kind of work information with public AI tools like ChatGPT or Gemini, including customer data and confidential financial documents. Nearly 40% of all AI interactions now involve sensitive data.
• Companies believe they have visibility into their AI risk, but they mostly don’t. 95% of organizations believe they can see their AI and machine identity exposure, but only 36% are monitoring it. And research by IDC found every organization surveyed struggled to produce a real count of its own AI agents
• The financial risk is climbing. IBM’s latest Cost of a Data Breach research found 43% of breached organizations had a shadow AI incident involved, more than double the 20% recorded just a year earlier, and breaches with an AI component now cost roughly $670,000 more on average.

The most effective fix isn’t a ban…because that will never work. Instead, give employees an approved AI tool to use, promote it heavily, and make it easy for them to access. That will cut unauthorized use by roughly 89%. And finally, treat every AI agent running inside company systems like a new hire that needs a named owner and a regular check-in.