'Organizations need to stop workarounds and regain control': Report finds many firms don't know what their workers are sharing with AI tools

Sailpoint's latest report exposes a critical blind spot in enterprise AI governance: 66% of UK organizations admit they cannot track whether employees are sharing data through approved AI platforms. This lack of visibility is compounded by shadow AI — workers frequently bypass company-approved tools in favor of popular alternatives like ChatGPT, Gemini, and Claude. Despite 82% of businesses investing in AI and data skills, and 41% hiring dedicated roles, 45% of IT leaders say they still lack sufficient insight into how and where company data is being shared across AI tools. Sailpoint CEO Mark McClain warns that without proper guardrails, the situation will spiral further out of control.

Agentic AI is making the problem worse. The report finds that 80% of organizations say AI agents are taking unintended actions, such as accessing or sharing the wrong data. At the same time, 12% of firms are now adding up to 10,000 AI agents or machine identities every month, dramatically expanding the attack surface. McClain argues that companies must stop relying on workarounds and instead treat AI as an identity challenge — assigning granular data access controls to both human users and AI agents. Two clear paths emerge: acknowledge the tools workers actually need and set proper guardrails, and apply identity-based access management to prevent unwarranted data leaks.