In a single year, the share of organizations using generative AI in at least one business function jumped from 33% to 71%, according to Stanford HAI's 2025 AI Index. A shift that fast is a stampede. I want to be clear that the boldness behind it is correct. The enterprises that win the next decade will be the ones that put frontier models to work first. My concern is not the speed. It is the gap the speed is opening underneath us.
The controls have not kept pace. IBM's 2025 Cost of a Data Breach report found that 63% of breached organizations either have no AI governance policy or are still building one, and concluded bluntly that AI adoption is greatly outpacing AI security and governance. We have a governance debt. Like most debt, it compounds quietly until it all comes due at once.
Shadow AI is a leadership problem
The most common way that debt surfaces is shadow AI, meaning employees using unsanctioned tools with corporate data. Microsoft's 2024 Work Trend Index found that 78% of AI users bring their own AI tools to work. Security vendors that monitor data flows report that roughly a third of the content employees paste into AI tools is sensitive. Discount any single vendor figure if you like; the pattern holds across several of them.
The instinct is to treat this as an employee discipline problem. I think that is backwards. People reach for unsanctioned tools because the sanctioned ones are slow, gated, or absent. When the official path takes a quarter to approve and the unofficial path takes thirty seconds, you have not written a security policy. You have created a workaround. The IBM data puts a price on it. One in five organizations suffered a breach tied to shadow AI, those breaches cost an average of $670,000 more, and 97% of the organizations that had an AI system breached lacked proper AI access controls.
Shadow AI does not yield to a stricter ban. It yields to a faster yes: a sanctioned, secured path that beats the workaround on convenience.
The new attack surface is real, and the failures are ordinary
The technical risks are well catalogued now. The OWASP Top 10 for LLM Applications (2025) ranks prompt injection first, followed by sensitive information disclosure, supply chain risk, data and model poisoning, improper output handling, and excessive agency. None of these is hypothetical. Samsung banned external generative AI on company devices in 2023 after engineers pasted semiconductor source code and a confidential meeting transcript into a public chatbot in three separate incidents over about three weeks. Wiz researchers documented Microsoft accidentally exposing 38 terabytes of internal data, including secrets and tens of thousands of internal messages, through a single over-permissioned cloud token attached to an AI training repository. In early 2025, Wiz found a DeepSeek database sitting open on the internet with plaintext chat history and API keys.
The most clarifying finding I have read comes from Microsoft's own AI Red Team, which published lessons from probing 100 generative AI products. Their conclusion: most of the damaging failures came from simple, familiar issues like unpatched dependencies, credentials in source code, and missing input and output sanitization, rather than exotic machine-learning attacks. That should be both reassuring and uncomfortable. Reassuring, because the disciplines that secure AI are mostly disciplines we already know. Uncomfortable, because we are skipping them in the rush.
Agents change the threat model
Everything above is the first wave, and it is mostly a confidentiality problem. Sensitive data goes somewhere it should not. The second wave is different in kind. When you give an AI agent tools and privileges, the risk is no longer only what it might say but what it might do. OWASP's agentic threat taxonomy names memory poisoning, tool misuse, privilege compromise, and rogue agents as the new attack surface.
Gartner expects agentic AI to be embedded in a third of enterprise software by 2028, up from less than 1% in 2024. It also predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing cost, unclear value, and inadequate risk controls. Read those two forecasts together and the message is plain. Agents are coming whether or not we are ready, and the projects that fail will mostly fail on governance rather than capability.
I keep seeing the same pattern. Organizations provision AI agents the way they once provisioned over-privileged service accounts: broad standing access, weak identity, no human in the loop on consequential actions. We spent fifteen years learning that lesson with machine identities. We do not have fifteen years to relearn it with agents. Identity, least privilege, and human approval for irreversible actions are the perimeter now.
Liability is catching up to security
If the engineering case does not move your board, the legal one will. A Canadian tribunal held Air Canada liable for its chatbot's misrepresentation and rejected the argument that the bot was somehow a separate entity. The principle is now on the record: you own your AI's outputs. On the regulatory side, the EU AI Act carries penalties of up to 35 million euros or 7% of global turnover, with obligations phasing in over the next several years. NIST has published a Generative AI Profile under its AI Risk Management Framework that explicitly calls for red-teaming, and ISO/IEC 42001 has arrived as the first certifiable AI management system standard.
All of this points to an emerging standard of care. Within a year or two, "we didn't know" will not hold up, technically or legally.
What good looks like
The throughline of my practice is that you can adopt AI boldly because you have built the foundation to contain its risks. In practice that means five things. Sanction and secure fast, so the approved tools beat the workaround. Inventory where AI is actually being used, and put real access controls around it. Build guardrails and continuous evaluation into the model lifecycle, from data and fine-tuning through deployment and agentic workflows, instead of testing once at launch. Secure the AI supply chain, including model provenance, data lineage, and third-party and open-source model risk. And treat governance as the thing that lets the business move faster with confidence, rather than the thing that pushes it into the shadows.
The enterprises that get this right will not be the most cautious ones. They will be the ones that made adoption safe enough to be aggressive.