42% of organizations globally identify a lack of visibility into the AI tools employees use as a significant identity governance gap.

47% of U.S. cybersecurity decision-makers report concern about lack of visibility into employee AI tool usage, compared with 42% globally.

42% of organizations report limited visibility into all AI tools or models used across the organization.

41% of enterprises say discovery of unknown AI agents happened multiple times in the past year.

47% of unknown AI agents emerge in LLM platforms, including custom tools, assistants, and plugins.

34% of enterprises report ownership visibility for just 26–50% of their AI agents.

54% of enterprises report having between 1 and 100 unsanctioned AI agents.

25% of organizations say shadow IT and unauthorized AI tool usage are a primary concern related to employee AI tool use and data security.

40% of unknown AI agents emerge in SaaS tools with built-in automation.

19% of enterprises identify shadow AI outside approved tools as a top anticipated risk.

Shadow AI accounted for 20% of AI-related breaches affecting financial institutions.

82% of enterprises have discovered previously unknown AI agents in the past year.

40% of unknown AI agents emerge in developer-created workflows.

Up to one third of employees operate beyond IT oversight when using AI.

More than 70% of employees worldwide use AI on a weekly basis.

59% of enterprises confirm or suspect the presence of shadow AI within their environments.

Roughly 80% of organizations describe 'shadow AI' use as moderate to pervasive.

25% of organizations have comprehensive visibility into employee AI use.

63% of organizations acknowledge that there is "shadow AI" within their organizations.

The share of organizations citing shadow AI as a definite or probable problem increased from 61% in 2025 to 76%, a 15-point year-over-year increase.