Over the years, enterprises have been in an all-out sprint to adopt the latest and greatest AI models. In that sprint, the average AI stack has grown quickly to include an array of platforms. These include developer tools, AI agents, employee-used services, and AI features embedded in existing applications.

Zscaler, a cloud-native cybersecurity platform, published data highlighting the risks associated with these trends in its ThreatLabz 2026 AI Security Report.

The report draws on an analysis of nearly a trillion AI and ML transactions generated by about 9,000 organizations during 2025. It found that AI/ML transactions across its platform climbed 83% year-over-year. Meanwhile, the number of applications generating that traffic nearly quadrupled to more than 3,400.

What this means for CISOs is that AI often interacts with sensitive enterprise data in areas that security teams are not actively monitoring or classifying as AI usage.

Much of this adoption happens outside traditional AI procurement or security review processes, which makes these trends difficult to manage. That adds a layer of ambiguity to an organization’s AI footprint.

Rampant AI adoption leaves security teams with a challenge. They have to identify what AI is actually in use, who has access to it, and where enterprise data is flowing. Without clear visibility into this activity, teams are haphazardly trying to secure an AI stack that they can’t fully see.

The Enterprise AI Footprint Is Expanding New iterations of AI can enter the enterprise ecosystem through more channels than what most security teams can track. It shows up in obvious places like sanctioned platforms and copilots that employees are trained to use.

But the enterprise AI footprint also expands discreetly. It grows through AI features built directly into existing software platforms and APIs that connect AI services to sensitive internal systems.

It also grows through autonomous agents that handle tasks on their own. Between February 2025 and April 2026, Salesforce customers with agents in production more than doubled their agentic AI workforce, according to Salesforce’s Agentic Enterprise Index. That signals widespread adoption of AI agents for otherwise human-centered tasks.

Separately, Zscaler’s ThreatLabz report found that data transfers to AI/ML applications surged 93% in 2025. It also counted 410 million data loss prevention (DLP) policy violations tied to ChatGPT alone, including attempts to share Social Security numbers, source code, and medical records.

Organizations may be surprised to learn that new software adoption alone does not explain the growth of this risk. For instance, an existing application might roll out an AI-powered feature. Employees then start using it as a natural extension of an approved tool they already trust. They do not treat it as a new system requiring separate review.

And then there is the shadow case of an employee adding an unsanctioned AI tool to streamline their work. Despite the good intentions, the employee typically doesn’t realize the data-handling risks they pose.

That kind of shadow AI means more rogue tools in more corners of the enterprise than any inventory can account for.

You Can’t Secure What You Can’t See Your security team is adept at safeguarding what they know exists in the enterprise AI stack. But a tool can slip past the company’s security approval or monitoring protocols without being hidden or unauthorized.

It only needs to operate outside the categories a security program was originally built to track. That could be a browser extension or a feature that activates automatically within an application already in use.

In a Gartner survey of 302 cybersecurity leaders, 69% said their organizations suspect or have evidence that employees are using prohibited public generative AI. A traditional application inventory is built around software that’s formally installed or procured. By design, it fails to account for this activity. Bringing shadow AI to the surface requires a comprehensive view of who is using these tools.

It also requires knowing which applications and systems they connect to, and what data they can access once connected. In many cases, AI functionality increasingly lives inside tools already approved for other purposes.

So the exposure isn’t a separate category of risk. It is a layer hidden within systems teams already thought they understood. AI Discovery Needs to Include Data Taking stock of the various tools within the enterprise AI stack only answers part of the question.

The more consequential piece of the inventory puzzle is accurately tracking what information moves into and through it. That starts once employees (or AI agents) use it. Prompts can include proprietary code or customer details.

And a seemingly innocent file upload can disclose an entire document that an unwitting employee didn’t intend to expose.

Agents bring a whole new level of complexity to the equation. The data they touch often extends into whatever applications and permissions sit behind them. A tool-focused inventory alone won’t be effective in capturing this activity.

Merely knowing that an application uses AI says little about whether it can draw from a customer database, write to a shared drive, or distribute data downstream to other services.

The benchmark for effective discovery is the ability to track data flows and permissions alongside the tools themselves. This is because the true risk lies in what AI can access and move, not just in its existence.

From AI Visibility to Risk-Based Control AI visibility leads to better decision-making. Once security teams have a sound understanding of AI usage, they can differentiate acceptable and low-risk activities from ones that warrant closer scrutiny or tighter controls.

That distinction allows controls to scale with real risk, rather than applying one blanket policy to every AI interaction. A marketing team might use an approved writing assistant on public content. The rules for that differ from the rules for an agent with access to financial records. In that case, security controls depend on the user, the application, data sensitivity, permission level, and use case.

In general, blocking AI tends to drive usage further underground, rather than reduce it. Proportionate controls give security teams room to allow legitimate use cases while still maintaining oversight. This is where AI visibility meets the Zero Trust and data protection principles most security programs already operate on. Verify continuously, grant access management based on context, and never trust by default.

AI Security Starts With Knowing Your AI Environment The efficacy of a governance policy is only as good as the visibility behind it. An organization can set strict rules about what is and isn’t allowed for AI. But it’s hard to enforce those rules without a clear, up-to-date view of what tools, applications, and agents really live throughout the enterprise. And that picture is always changing. New AI capabilities keep showing up in existing software. And agents are taking on more and more autonomous roles in workflows. So AI discovery needs to be an ongoing process, not a one-time audit.

Based on Zscaler’s findings and takeaways from the report, organizations will be in a better position to secure AI with clear visibility. That means visibility into how AI is used, who accesses it, and how enterprise data flows through it.

That visibility turns a fast-growing and often murky AI footprint into something security teams can govern with confidence.