AI moves fast. Stay in the know.

A recent survey found that organizations are facing rising and often unexpected costs as they expand workplace AI adoption. While businesses expect AI tools and agents to improve productivity, IT leaders are struggling to measure usage and business value because adoption increasingly happens outside formal governance processes. Employees are also using unapproved tools and personal AI accounts for work, while some AI systems have taken actions that caused financial, legal, compliance, or reputational harm. The findings show that AI productivity cannot be separated from visibility, governance, and risk management.

Source: ITPro

What to know:

• More than 80% of surveyed UK IT leaders reported unexpected increases in AI-related costs during the previous 12 months.
• Over 60% said they were highly or fully accountable for AI-driven business outcomes, despite lacking complete visibility into how AI was being adopted and used across departments.
• One-quarter of workers said they frequently use AI tools that have not been formally approved by their organization.
• Another 38% regularly use personal AI accounts for work, creating potential visibility, data-protection, and governance gaps.
• IT leaders estimated that 30% of new AI tools and agents introduced during the previous year had bypassed formal IT review or approval.
• More than half of IT leaders said an AI tool or agent had taken an action that resulted in financial, legal, reputational, or compliance harm.
• AI productivity was also affected by output quality and missing business context: 37% of knowledge workers spent at least 30 minutes each day correcting or reworking AI-generated outputs.

Why it matters:

For mid-sized businesses adopting GenAI, increased AI activity does not automatically translate into measurable productivity or business value. When employees use personal accounts, unauthorized tools, or AI agents outside formal review processes, organizations may be unable to determine where sensitive data is being shared, whether internal policies are being followed, or which tools are creating risk and unnecessary costs.

This reinforces the need for organization-wide AI usage visibility, shadow AI discovery, prompt-level monitoring, sensitive-data protection, and policy enforcement. By monitoring how employees interact with GenAI tools, businesses can support productive AI adoption while identifying risky behavior, reducing uncontrolled costs, and preventing AI use from creating compliance, security, or reputational damage.

A recent cybersecurity article highlighted how AI agents integrated into business workflows can increase insider-threat risks when they are given access to sensitive systems, files, emails, and enterprise applications. The article described research showing how agents connected to tools such as Salesforce, Outlook, SharePoint, OneDrive, and endpoint files could be prompted to access, summarize, move, or transfer business data within minutes. The concern is not necessarily a software flaw, but a governance and visibility gap: businesses are adopting agentic AI faster than they are implementing prompt logging, access controls, audit trails, and monitoring.

Source: CyberScoop

What to know:

• AI agents are increasingly being embedded into business systems, giving them access to workflows, applications, files, and enterprise data.
• Recent research tested scenarios where an AI agent was prompted to summarize Salesforce information into an Outlook email and transfer selected files through an AI coworking app.
• The tests showed that sensitive data movement could happen quickly when agents have broad access to business tools and cloud systems.
• The article emphasized that the risk is less about a traditional software vulnerability and more about weak AI governance, visibility, and control.
• Without prompt logging and audit trails, businesses may struggle to understand whether a data leak was caused by a user, an agent, or malicious instructions.
• Key risks include insider misuse, accidental data exposure, excessive permissions, unmanaged AI workflows, and limited visibility into agent-driven actions.

Why it matters:

For mid-sized businesses adopting GenAI, AI agents can quietly expand insider-risk exposure because they act across systems that already contain sensitive business data. If an employee or malicious insider can use an agent to access, summarize, move, or share information faster than security teams can detect it, traditional monitoring may not be enough. This reinforces the need for AI usage visibility, prompt and action logging, access governance, anomaly detection, and continuous security monitoring so businesses can identify risky AI-driven behavior before it leads to data leakage, compliance gaps, or operational damage.