The Biggest AI Risk Wears an Employee Badge

The AI risk that worries security professionals most is not a hacker with a clever prompt. It is a colleague with a deadline, a badge, and a browser tab open to a chatbot.

That is the central finding of a September 2026 O’Reilly survey of 209 security-involved professionals. Forty-nine percent named sensitive data leaking through commercial AI tools as a main concern. Another 49 percent named staff trusting AI output without checking it. Prompt injection, the threat that dominates conference stages, was named by only 11 percent.

The numbers point to a gap between writing a policy and controlling what happens to data. Most organizations have an AI policy. Far fewer can show that the policy changes what happens when someone pastes a contract, a customer file, or source code into an AI tool. This post walks through what the survey found, why a policy alone does not close the gap, and what changes when AI access to sensitive data runs through a control plane for secure data exchange with policy enforcement and a unified audit log, the model behind Kiteworks Compliant AI and the Kiteworks Secure MCP Server.

Key Takeaways

1. The top AI worry is internal.

In the O’Reilly survey, 49 percent named data leaking through commercial AI tools, and the same share named overreliance on unverified AI output. Prompt injection came in at 11 percent.

2. A policy is not a control.

Seventy-two percent have an AI use policy, but only 44 percent call it comprehensive, and widespread shadow AI was reported by 35 percent of respondents with a basic policy versus 17 percent with a comprehensive one.

3. Shadow AI is a perception signal, not a leak rate.

Fifty-nine percent believe colleagues use AI outside policy at least occasionally. Validate that belief with your own telemetry before reporting it as measured exposure.

4. Agents add an identity problem on top of a behavior problem.

Respondents worried about excessive permissions or unclear ownership (28 percent), weak monitoring and auditability (19 percent), and the inability to verify that an agent stayed in role (18 percent).

5. Enforce policy where the data lives.

Routing AI access to sensitive data through a control plane lets you authenticate the identity, apply policy on every request, and write one tamper-evident audit log.

What the O’Reilly survey measured

O’Reilly fielded the survey in September 2026 and analyzed the 209 respondents who work in security. Two caveats matter before anyone quotes it. The respondents are self-selected, and 209 is a small sample, so the results show where security professionals feel exposed. They do not show how often incidents occur.

The second caveat concerns the shadow AI figure. O’Reilly defines shadow AI as AI use outside any definitive policy. The 59 percent figure (36 percent occasional, 23 percent widespread) is the share of respondents who believe their teammates use AI that way. It is a belief about colleagues’ behavior, not a measured rate of sensitive data leaving the organization. Write it that way in your board deck.

Even with those limits, the ranking is informative. When security professionals choose between the exotic and the mundane, they pick the mundane. Their biggest fear is an ordinary employee doing an ordinary thing with a very capable tool.

A policy on paper does not change behavior

Seventy-two percent of O’Reilly’s respondents say their organization has an AI use policy. Only 44 percent call it comprehensive. The difference shows up in behavior. Respondents with comprehensive policies reported widespread shadow AI at 17 percent. Those with basic policies reported 35 percent, and those with no policy reported 37 percent.

Read that carefully. Comprehensive policies are associated with less shadow AI, which is good news for anyone who has invested in writing one. But 17 percent is still nearly one in five organizations where respondents describe widespread use outside policy, even with the best paperwork.

Another survey shows the same pattern from the audit side. Schellman surveyed 525 US professionals at large companies, and 64 percent said they have a formal AI acceptable use policy communicated to employees. Seventy-four percent believe they could pass an AI compliance audit today. Only 27 percent describe their governance program as fully mature, and 44 percent have AI-specific incident response procedures. Schellman sells AI assessments, and its sample differs from O’Reilly’s, so do not add the two together. Read them side by side.

The gap between “we have a policy” and “we can prove it works” is where compliance officers get hurt. An auditor, a regulator, or a plaintiff’s lawyer will not ask whether the policy exists. They will ask for evidence of what happened to specific data on a specific day. The Kiteworks Data Security and Compliance Risk: 2026 Annual Survey Report captures how organizations respond when they discover the gap. Of 459 security and compliance professionals surveyed, 65 percent found employees using unapproved AI tools with organizational data in the past 12 months, and only about 28 percent had AI-specific data loss prevention in place. The most common response was updated policy guidance. Fewer than half of those that found shadow AI deployed technical controls. All findings in that report are self-reported, and discovery reflects detection capability as much as prevalence.

The telemetry points in the same direction

Perception is one thing. What do the logs say? The Verizon 2026 Data Breach Investigations Report found that 45 percent of employees are now regular AI users on corporate devices, up from 15 percent the year before. Of those users, 67 percent reach AI services through non-corporate accounts. That is an incident dataset rather than a survey, and it describes accounts, not intent. It still shows the practical meaning of shadow AI. The data goes to an account the organization neither controls nor logs.

Employees say the same thing about themselves. In the National Cybersecurity Alliance and CybSafe report, 32 percent of employees who use AI at work admitted sharing sensitive company information with AI tools without their employer’s knowledge. The base is 5,000 adults across the United States, the United Kingdom, India, Brazil, and Singapore, and the answers are self-reported. Put O’Reilly’s perception data, the NCA self-reports, and Verizon’s telemetry together and the picture holds. People are using AI at work, often outside sanctioned accounts, and organizations have limited evidence of what goes in.

Agents turn an employee problem into an identity problem

O’Reilly also asked about AI agents. The leading worries were excessive permissions or unclear ownership (28 percent), lack of monitoring or auditability (19 percent), and the inability to verify whether an agent stayed within its authorized role (18 percent). None of these concerns is about the model. All three are about identity, authorization, and evidence.

Governance practice has not caught up. In the Schellman survey, only 22 percent have defined thresholds that trigger human review of agent actions. Thirty-eight percent review only high-risk actions, and 32 percent review all of them.

The practical lesson is that agents are not a separate species of risk. They are another class of identity that acts on data, and they need the same governance rigor as the people who deploy them. An agent needs a named human owner, permissions scoped to the task, and an audit trail that stands up the same way an employee’s does. The question is the same for both. Who accessed what, under which policy, with what result?

What changes when AI access runs through a control plane

If employees will use AI anyway, the strongest move is to give them an approved path that is easier than the unapproved one and that leaves evidence. That is the idea behind routing AI access through a control plane.

Kiteworks Compliant AI governs AI agent access to regulated data at the data layer, independent of the model, the prompt, or the agent framework. Every request passes four checkpoints. The platform authenticates the identity through OAuth 2.0, enforces attribute-based access control policy, protects data with FIPS 140-3 validated encryption, and writes tamper-evident audit logs that stream to a SIEM. The Kiteworks Secure MCP Server applies the same logic to Model Context Protocol connections. It links LLM clients such as Claude and Copilot to data held in Kiteworks, evaluates each request against role-based and attribute-based policy, and returns only what policy allows. The platform authorizes and logs every operation in the control plane for secure data exchange.

The reasoning for the data layer is simple. A system prompt or model-side safety filter can be bypassed by a determined or merely creative user, which is Kiteworks’ position and the reason it enforces policy where the data lives. An access decision made at the data layer does not depend on what the model was told to do. The Data Policy Engine evaluates the user, the data, and the action on every request, and the same zero trust data exchange principles apply whether the requester is a person or an agent. For readers who want the broader framework, the AI data governance guide and the guide to zero trust and generative AI go deeper.

Evidence is the second benefit. In Kiteworks 2026 Annual Survey Report, only 27 percent of organizations can produce a complete AI audit record within one business day, and 17 percent can do it within one hour. That is the same weakness behind the 19 percent of O’Reilly respondents who worry about monitoring and auditability. A unified audit log that covers people, systems, and AI agents across email, file sharing, APIs, and AI integrations turns “we believe” into “here is the record.”

One limit deserves a plain statement. Routing AI through a control plane governs the sensitive data that lives in it and the AI access that goes through it. It does not stop an employee from pasting text into a consumer chatbot in a browser. That exposure needs data loss prevention tuned for AI tools, endpoint and browser controls, and training. The strongest programs combine an approved, governed path with controls on the unapproved ones.

A practical 90-day plan for CISOs and compliance leaders

Security and compliance leaders can turn the survey into action without waiting for a new budget cycle. Start with these six moves.

1. Measure before you believe. Replace the perception number with telemetry. Count AI tool use by account type, by data class, and by department.
2. Pair every policy sentence with a control and an evidence source. If a clause says “do not enter customer data into unapproved tools,” name the control that enforces it and the log that proves it. Good data governance works this way.
3. Build the approved path first. Give employees AI access to the data they legitimately need, with access controls that follow the data.
4. Register agents like identities. Each agent gets a named human owner, scoped permissions, and a revocation path. Review its actions on the same cadence as a privileged user.
5. Rehearse the audit request. Pick a day last month and try to produce a complete record of every AI interaction with sensitive data. Time it. Compare your result with the 27 percent and 17 percent benchmarks above.
6. Report with named bases. Tell the board which survey, which sample, and which question each number comes from, and give leaders a single CISO dashboard view of AI access across channels.

The employee badge is not going away, and neither is the AI tool on the screen next to it. The organizations that handle this well will be the ones that can show, with evidence, what AI touched and under whose authority.

To learn more about how Kiteworks governs AI access to sensitive data, schedule a demo.

Additional Resources

• Blog Post
  Zero‑Trust Strategies for Affordable AI Privacy Protection
• Blog Post
  How 77% of Organizations Are Failing at AI Data Security
• eBook
  AI Governance Gap: Why 91% of Small Companies Are Playing Russian Roulette with Data Security in 2025
• Blog Post
  There’s No “–dangerously-skip-permissions” for Your Data
• Blog Post
  Regulators Are Done Asking Whether You Have an AI Policy. They Want Proof It Works.