ai risk today logo svg bl font
Menu
SUBSCRIBE
SUBSCRIBE
ai risk today logo svg bl font
Menu

shadow AI

Visualization of AI governance and browser activity illustrating violations of company AI policies.

48.3% Of U.S. Employees Admit To Breaking Company AI Policies

, , , , , , , , , , , ,

Nearly seven in 10 employees also reported pasting sensitive company data into AI tools, suggesting many organizations face an enforcement problem rather than an awareness problem.

Key Takeaways

  • 48.3% of U.S. employees knowingly breach their company’s AI policy.
  • 68.7% said they pasted internal, sensitive, or regulated data into AI tools in the last three months.
  • 70.9% use AI tools daily for work.
  • 42.3% reported using approved and unapproved AI tools side by side during the same browser session.
  • 49.3% said they would use an unapproved AI tool if their preferred tool was not authorized.

Neon Cyber’s report, Quantifying Shadow AI Risk in the Browser, suggests many organizations face a growing AI governance challenge that extends beyond policy development. The survey of 227 U.S. employees who use AI at work found that nearly half knowingly violate their employer’s AI policies despite understanding those rules.

The report argues that the problem is no longer whether organizations have AI policies. Instead, it suggests many organizations struggle to enforce them where employees actually use AI.

Policy is not changing behavior

Among respondents, 63.0% said their organization has a clear AI policy they understand. Of those employees, 48.3% admitted they knowingly breached that policy.

The report also found that 39.6% knowingly used unapproved AI tools, while another 15.0% said they might have. Nearly half (49.3%) said they would simply switch to another unauthorized AI tool if the one they wanted was not approved by their employer.

According to the report, employees often prioritize productivity over internal approval processes, particularly as AI tools become a routine part of daily work.

Sensitive company data continues flowing into AI

The survey found that 68.7% of respondents pasted or uploaded internal, sensitive, or regulated information into AI tools during the last three months, including financial information, customer data, and login credentials.

Shadow AI is becoming routine

More than 70% said they use AI tools daily, while 51.1% reported using them multiple times each day. Nearly two-thirds described AI as essential or very necessary to their jobs.

At the same time, 42.3% said they use both approved enterprise AI tools and unapproved AI services in the same browser session, using the same corporate data. The report argues that this makes it difficult for organizations to detect unauthorized AI activity using traditional security controls.

Browser habits also contributed to the risk. Nearly 70% reported using the same browser profile for both work and personal activities, while 63.0% said they mix personal and work accounts within the same browsing session.

Neon Cyber conducted the survey in May 2026 among 227 self-identified U.S. employees who use AI at work.

Netwrix 2026 Data and Identity Security Report cover, a geometric mosaic in dark navy and teal with the report title and subtitle.

Netwrix: Companies Deploying AI Breach At Four Times The Rate Of Peers

, , , , , , , , , , ,

Fast AI adopters breach at 43%, four times the 11% rate of slower peers, despite outperforming them on every security fundamental Netwrix measured.

Key Takeaways

  • Companies that have broadly deployed AI breach at 43%, four times the 11% rate for companies that have not
  • Fast AI adopters are ahead on security fundamentals, yet they breach more; AI deployments are creating new automated accounts and AI agents faster than security teams can track and control them
  • 76% of organizations do not fully track or control the AI agents and automated systems running inside their networks
  • 41% already have AI agents running in production, with those agents accessing company data on behalf of employees
  • 74% have no clear picture of which AI agents and accounts can access their sensitive data
  • Only 11% have AI governance that is fully enforced with consistent controls over who and what can access company data, applied in real time
  • Mid-size companies (500-999 employees) report the highest breach rate of any company size at 40%

Netwrix, a data security company, released its 2026 Data & Identity Security Report, finding that organizations in which AI has significantly increased the number of digital identities in their environments reported a 43% breach rate over the past 12 months. In security terms, an identity is any account with access to company systems: a human employee, an AI agent, a bot, or an automated service. Organizations where AI has not meaningfully expanded that number reported 11%. Netwrix surveyed 2,317 security and IT professionals across more than 60 industries worldwide.

 

Fast AI adopters are ahead on security fundamentals, yet they breach more

The gap is not explained by weaker security practices among faster AI adopters. Organizations leaning hardest into AI are measurably ahead on identity security fundamentals:

  • 46% lack a current picture of what data they hold and where it is stored, versus 60% among slower peers
  • 75% have strong controls over AI agents and automated systems with access to company data, versus 56% among slower peers
  • Only 13% cannot see which AI tools employees are using without company approval, versus 25% among slower peers

“They invested in the playbook. They got breached anyway,” wrote Grady Summers, Netwrix chief executive officer and a former Fortune 500 chief information security officer (CISO), in the report’s executive summary.

 

AI creates identities faster than governance tools can keep up

Summers says the problem is structural. Identity governance tools were built for environments where identities grew at the pace of hiring. AI agents, copilots, and automated services add new identities at the pace of software deployment. Every new agent is a new identity requesting access to sensitive data. Static or periodically reviewed permission models were not designed for that cadence.

The supporting data reflects that gap. 76% of respondents say they do not fully govern or monitor non-human identities in their environments. 41% say they already run AI agents in production, with those agents accessing company data on behalf of employees. 74% lack a single, unified view of sensitive data and which identities can reach it.

 

Mid-market breach risk is highest; only 11% have reached full governance maturity

The breach risk is highest in the mid-market. Organizations with 500 to 999 employees reported a 40% breach rate, the highest among company size ranges in the survey. Large enterprises with 10,000 or more employees reported 27.3%. Organizations with fewer than 500 employees reported 17.8%.

The report maps organizations across five AI governance maturity tiers. Just 11% have reached the level the report calls fully operational, meaning enforced, continuous, and proactive governance over every identity and the data it can reach.

 

With 41% of organizations already running AI agents in production and just 11% at full governance maturity, most are still building the controls that AI is already outpacing.

Futuristic city skyline with glowing data streams and network lines, from Check Point's 2026 Cloud Security Report.

77% Of Companies Changed Security Strategy For AI; Only 26% Can Enforce It

, , , , , , , , , , ,

Check Point’s 2026 Cloud Security Report finds more than half of companies already confirmed an AI-related security incident, and another quarter cannot rule one out.

Key Takeaways

  • 77% of companies changed their security strategy to manage internal AI use, but only 26% say their security systems can enforce those changes without a major rebuild
  • 54% confirmed at least one AI-related security incident. Another 24% suspect one but lack the monitoring to confirm it
  • Only 5% of security teams have full visibility into which AI tools employees use and where their data goes
  • Just 13% can block a malicious prompt before it reaches a model, and 5% can stop an AI response that leaks sensitive data or carries malicious content
  • 42% of organizations say employees bypass AI security controls when those controls slow them down

Check Point Software released its 2026 Cloud Security Report: Securing the AI Transformation, a study of how enterprise security is holding up as AI moves into production. Check Point surveyed 1,042 cybersecurity and IT professionals in early 2026, asking how AI has changed their security strategy, architecture, and day-to-day operations. The answers point in one direction: strategy is moving fast, and the infrastructure underneath it is not.

 

A 51-point gap between strategy and enforcement

AI adoption forced 77% of organizations to change how they manage security. As employees adopted tools like ChatGPT and Copilot, companies built AI into their own applications, security teams rewrote acceptable use policies, established AI governance boards, and redirected budgets toward AI-specific controls. But only 26% say their existing security systems can enforce those changes without a major rebuild.

The gap matters because AI is already running at scale. 70% of organizations run generative AI in production, 64% have AI agents in pilot or production, and 12% have given those agents privileged access to core systems. In plain terms: most companies decided what their AI rules should be, but few can apply those rules where AI actually operates.

 

More than half of companies report an AI incident, almost a quarter more suspect one

54% of organizations confirmed at least one AI-related security incident. Another 24% suspect an incident but lack the monitoring to confirm it. Combined, 78% either took a hit or cannot rule one out.

The most common incidents reported were:

  • Unauthorized or shadow AI use (41%)
  • AI-generated content used in an attack, such as phishing or deepfakes (37%)
  • Sensitive data leaked to or through AI services (32%)

 

Security teams see little and stop less

Only 5% of security teams have full visibility into which AI tools employees use, what data those tools touch, and where that data goes.

Enforcement is not much better. 13% can block a malicious prompt before it reaches a model. 16% can stop sensitive data from reaching AI services in real time. Just 5% can reliably stop an unsafe AI response before it reaches users or other systems. Most tools can raise an alert after the fact but cannot stop the activity in real time.

Weak enforcement gives employees a way around the rules. 42% of organizations say employees bypass AI security controls when those controls slow them down, often by pasting data into a personal AI account or using a browser-based tool the company’s security software does not cover.

 

Companies are shifting security budgets to close the gap

52% of organizations are increasing their AI security budgets, and 37% are replacing their collection of security tools with a single platform, nearly double the 20% still buying a separate tool for each problem. Regulation may force the pace: only 7% say they are fully prepared for AI-specific rules such as the EU AI Act and new state laws in Illinois and Colorado.