According to one report, 89 percent of enterprise AI usage is invisible to the organization, even with security policies in place.

According to Help Net Security (89 percent of enterprise AI usage is invisible to the organization, available here), according to a LayerX report, 71% of connections to GenAI tools are done using personal non-corporate accounts. Among logins using corporate accounts, 58% of connections are done without Single-Sign On (SSO). These interactions bypass organizational identity and access management (IAM) systems, leaving security teams blind to how GenAI tools are used and what data is being shared.

Software developers are the largest constituency of active users. Among enterprise users, 39% of users who use GenAI tools belong to research and development, 28% belong to sales and marketing. IT, HR, and finance users make up single digits only.

The research shows that 20.63% of all users have installed an AI-enabled browser extension. Of those who have such an extension installed, 45% have more than one such extension. 58% of GenAI browser extensions have a permission scope classified as ‘high’ or ‘critical’. Even worse, 5.6% of AI extensions are classified as ‘malicious’ and can be used to steal data. Ruh-roh!

90% AI usage is concentrated in large, well-known apps, but there is a long tail of shadow AI applications. ChatGPT alone accounts for 50% of enterprise usage, and the top 5 AI SaaS apps for 85% of AI usage.

Perhaps one of the biggest concerns is that approximately 18% of users paste data to GenAI tools, and about 50% of that is company information. Yeesh!

Am I surprised by these numbers? No – it’s still a “wild west” out there, even in corporations with established policies. While it’s not clear from the article the makeup of the respondent group (and there is no link to the report itself), these numbers still illustrate how organizations are struggling to get a handle on AI usage of their team members.

So, what do you think? Are you surprised at the report that 89 percent of enterprise AI usage is invisible to the organization? Please share any comments you might have or if you’d like to know more about a particular topic.

Hat tip to Jeffrey Brandt and Pinhawk for the heads up on this story!

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by my employer, my partners or my clients. eDiscovery Today is made available solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Today should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.