IBM's 2026 Cost of a Data Breach Report put a number on the governance gap this year. 68% of breached organizations had no policy to govern AI use or detect its unsanctioned use. The more damning figure sits one layer down. Of the organizations that suffered an AI-related breach, 92% had no adequate access controls on their AI models and data.
Read those two numbers together and they describe something more specific than immaturity. The organizations in that study weren't all ungoverned. Plenty of them had a committee, a risk register, a model inventory, and a sign off process that took months to negotiate with legal. What they didn't have was coverage. The governance existed. It just wasn't pointed at the AI that actually breached them.
This is the uncomfortable arithmetic of AI sprawl. Governance was designed around a mental model where AI is something you decide to do. It’s a project that gets funded, a model gets selected, a review happens, and a system that goes live. That model was accurate for about 18 months. It's now describing the smallest of the three routes by which AI enters an enterprise. And the only one anybody is watching closely.
Where does most of your enterprise AI actually come from?
Not from projects. Start with the route nobody approved because nobody was asked. Gartner projects that 40% of enterprise applications will be integrated with task specific AI agents by the end of 2026. That’s up from less than 5% in 2025. Not applications you'll buy. Applications you already own.
Read that as a governance statement rather than a market forecast. Your CRM, your ticketing system, your HR platform, and your document management tools. A large share of them will ship agentic capability inside the maintenance release, enabled by default, with a changelog entry and no procurement event. There's no vendor selection to review because the vendor was selected in 2021. There's no model decision to approve because the model is the vendor's, and it may change next quarter without telling you.
The AI you commissioned went through review. The AI that arrived in a product update didn't, and there's more of it.
Does vendor diligence cover the AI inside their products?
Only partly, though the instinct is to treat it as covered. The vendor is contracted, the vendor is SOC 2 audited, the vendor has a data processing agreement. Someone did diligence.
Verizon's 2026 Data Breach Investigations Report, published in May, should complicate that comfort. Third party involvement in breaches rose 60% year over year and now show up in 48% of all breaches. That’s roughly half. The report spans more than 22,000 confirmed breaches across 145 countries, so this isn't a sampling artifact. It's the shape of the modern attack surface.
Now layer the agentic capability onto that supply chain. An agent embedded in a vendor product doesn't just process your data. It acts on your systems, holds credentials, makes calls to other services, and does so with a permission set that was scoped for a human user performing occasional tasks, not an autonomous process running continuously.
Your contract governs the vendor's obligations. It doesn't govern what their agent can reach inside your environment. Those are different questions, and only one of them was answered during procurement.
Why do employees keep using unapproved AI tools?
Because the approved route is slower than the work. The third route is the one that gets the headlines and the least useful response. The same Verizon report found that employee use of unapproved AI tripled. 45% of employees are now considered regular AI users on corporate devices, with 67% of users reaching AI services through non corporate accounts.
Shadow AI has become the third most common non-malicious insider action in the data loss prevention dataset. That’s a 4x increase in just 12 months. And frighteningly enough, the most common category of data being submitted to external models is source code.
The standard response is a policy and a training module. News flash…it doesn't work. And the reason it doesn't work is visible in the numbers. People aren't doing this because they missed the memo. They're doing it because the sanctioned path takes 11 weeks and the unsanctioned one takes 11 seconds.
Shadow AI is a symptom of procurement latency, not of employee recklessness. Every organization I've seen reduce it meaningfully did so by shortening the approved path rather than lengthening the punishment for avoiding it. If your review process is slower than the problem your employee is trying to solve, you haven't built governance. You've built an incentive to route around you.
How many ways does AI enter the enterprise?
Here's a framing that makes sense to everyone, in every level throughout the enterprise. AI essentially enters through three doors:
- The front door is the AI you commissioned, and your existing governance covers it well.
- The side door is the AI your vendor shipped into a product you already own.
- The back door is the AI your employee opened this morning.
Most governance programs guard the front door thoroughly and leave the other two unattended. The fix isn't three separate programs. It's one register that records all three, because the risk questions are identical regardless of how the capability arrived.
Things like:
- What data can it reach
- What actions can it take
- Who is accountable when it's wrong
- How would you know if it was
Maintaining that register is where most attempts collapse. A quarterly survey will be stale before it's circulated. What works is instrumentation. Identity and network telemetry that shows which AI services are being reached and by whom. Vendor release monitoring that flags when a contracted product enables new agentic capability. And permission auditing that treats any non human principal as a reviewable identity in its own right.
The distinction that makes this tractable is between inventory and control. Most organizations responding to AI sprawl start by trying to count everything. They produce a spreadsheet with 200 rows only to discover that the count is wrong within 48 hours. Counting isn't the goal. Knowing which of those 200 can reach regulated data, move money, or write to a production system is the goal. And that's a much shorter list you can actually govern.
How do you govern AI you can't inspect?
You govern the boundary instead of the build, which is uncomfortable for teams who built their governance practice around model review. You can't govern AI you didn't build by inspecting how it was built. You won't see the vendor's training data and you won't approve their model updates. The build isn't available to you.
What is available to you is the boundary. What data can this thing reach, under whose identity, with what permissions, and producing what record of what it did. Those controls work identically whether the AI was commissioned, purchased, or smuggled in, because they sit at the point where the AI meets your data. Not at the point where the AI was created.
That's a real change in posture. It moves governance from a gate that things pass through once to a property of the environment that holds continuously. It also means your access management and data classification work, which has never been anyone's favorite program, is now the load bearing element of your AI risk posture.
So the question for your next governance review isn't which AI projects need approval. Your committee already knows those. The question is harder and more revealing. If a vendor enabled an autonomous agent inside a product you already own tomorrow, with access to the data that product already holds, how long would it take you to find out?
If the answer is measured in quarters, or if the honest answer is that you would find out when something went wrong, the committee is reviewing the wrong three projects. AI sprawl isn't a future risk to be managed once the current program lands. It's the current state of the estate, and the only question is whether your governance is describing it or imagining it.
We should talk soon if you're unsure. Our goal is to make the transition to the AI era as seamless as possible, so please reach out if you need help.
Explore more blog posts from Unframe.
