Companies are expanding employee access to artificial intelligence even as security incidents, data concerns and governance challenges expose a widening gap between AI ambition and enterprise readiness.
The enterprise AI boom shows little sign of slowing down—even as the risks associated with deploying the technology become harder for companies to ignore.
Worker access to artificial intelligence increased by 50% in 2025, according to research cited in recent industry reporting. At the same time, 86% of surveyed organizations said they had investigated at least one AI-related security or operational incident during the previous 12 months.
The numbers point to an uncomfortable reality for technology and security leaders: AI adoption is accelerating faster than many organizations can build the controls needed to manage it.
Rather than treating security concerns as a reason to slow down, companies increasingly appear to be treating them as a cost of doing business with AI.
Adoption is winning the argument
For years, enterprise technology rollouts have typically followed a familiar pattern. A new technology emerges, security and compliance teams evaluate the risks, policies are established, and adoption proceeds cautiously.
AI is disrupting that sequence.
Employees are already using generative AI to write documents, analyze information, generate software code, summarize meetings and automate routine tasks. Organizations are also moving beyond individual productivity tools toward AI embedded in business applications and workflows.
That momentum is difficult to reverse.
The result is a growing tension between AI’s perceived business value and the risks created by its rapid deployment.
Other research reinforces the scale of the shift. A 2025 Cloudera survey found that 96% of enterprises had AI at least somewhat integrated into core business processes, with 21% describing AI as fully integrated and powering critical business decisions.
For businesses, the question is increasingly not whether employees will use AI. It is how much control the organization will have over that usage.
Security incidents aren’t stopping the expansion
The 86% incident figure is particularly significant because it suggests AI-related problems are no longer theoretical.
Organizations are encountering security and operational issues while simultaneously expanding their use of the technology.
Those problems can take many forms: sensitive information being exposed to AI systems, unauthorized access, insecure third-party applications, unreliable AI-generated content or employees using tools that have not been approved by their IT departments.
Data leakage is already one of the industry’s prominent concerns. Cloudera’s research found that half of respondents identified data leakage as a major AI security concern, followed by unauthorized access and insecure third-party tools.
The challenge becomes more complicated as AI systems gain access to more corporate data.
An employee asking an AI chatbot to summarize a public document presents relatively little risk. An AI system connected to internal financial records, customer databases, source code or confidential strategy documents presents an entirely different security problem.
And the next generation of AI systems—AI agents capable of taking actions rather than simply generating responses—raises the stakes further.
The rise of the AI agent
AI agents could fundamentally change the risk equation.
A traditional chatbot generally waits for a person to ask a question and then produces an answer. An agent can potentially interact with software, retrieve information, make decisions and execute tasks with considerably less human intervention.
That creates a new category of enterprise risk.
Companies may not completely trust autonomous AI, but they are increasingly unwilling to sit out its development. The result is a widening gap between confidence and investment.
That gap could become one of the defining characteristics of enterprise AI adoption.
Shadow AI makes the problem harder
Perhaps the biggest challenge for security teams is that not all enterprise AI adoption is happening through official channels.
Employees can sign up for AI services in minutes, often without involving IT. They may use these tools because they are faster or more capable than approved corporate alternatives.
This creates what security professionals increasingly call shadow AI: AI usage that exists outside an organization’s formal governance and security framework.
The problem is visibility.
If security teams do not know which AI services employees are using, what information is being submitted to those services or what permissions those applications have, they have limited ability to manage the associated risks.
That creates a fundamental contradiction: companies are trying to govern AI while potentially lacking a complete picture of where AI is being used.
Security may have to change its role
The traditional strategy of blocking risky technology is becoming increasingly difficult to sustain. If AI is delivering measurable productivity gains, employees and business leaders have strong incentives to continue using it.
Security teams therefore may have to move from “stop AI” to “secure AI.”
That means discovering which AI systems are being used, determining what data they can access, establishing appropriate permissions, monitoring their behavior and creating clear rules for when humans must remain in control.
It also means treating AI less like a standalone application and more like a new layer across the enterprise technology environment.
Frank Palermo, COO of NewRocket, has pointed to a related challenge: organizations need to consider how AI fits into existing workflows, data and business processes rather than treating it simply as another technology deployment. That distinction becomes increasingly important as companies move from isolated AI experiments to systems embedded in everyday operations.
The security perimeter is consequently becoming harder to define.
The AI paradox
The most important lesson from the latest data may be that security concerns are not necessarily reducing AI adoption—they are becoming intertwined with it.
Companies recognize the risks. They are investigating incidents and increasing attention to governance and security. Yet employees are gaining greater access to AI and organizations are embedding the technology deeper into their operations.
That creates what could be called the enterprise AI paradox:
The more companies learn about the risks of AI, the more they appear to recognize that they cannot afford not to use it.
The result is unlikely to be a retreat from AI.
Instead, the next phase of enterprise adoption will be defined by a race between deployment and governance. Companies that can establish visibility, security controls and accountability without crippling AI’s usefulness will have an advantage over organizations that either deploy recklessly or attempt to block the technology altogether.
AI adoption is no longer waiting for security to catch up.
Security is now being forced to catch up with AI.
Be First to Comment