Building a Stronger Foundation for AI Governance
Artificial intelligence is becoming an integral part of everyday business operations. Employees use AI assistants to summarize information, generate content, analyze data, and automate repetitive tasks. While these capabilities create opportunities for productivity and innovation, they also introduce a growing challenge for IT and security teams: understanding how AI is being used across the organization and whether that usage aligns with established security policies.
In its Securing AI Usage Starts in the Browser report, Omdia highlights the growing importance of browser-level security as organizations expand their use of generative AI. The research, commissioned by Google and based on a survey of 400 IT and cybersecurity professionals across North America, identifies AI application security as a leading priority for secure browsing investments.
For organizations adopting AI at scale, the challenge extends beyond protecting the browser. They also need visibility into the AI applications, models, and workflow platforms already present across their environments. Google Endpoints Readiness Tool (GRT) supports this objective through AI Usage Insights, helping organizations understand their AI footprint and establish a stronger foundation for governance.
Why AI Usage Has Become a Security Priority
The browser has become a central environment for modern work. According to the Omdia research on browser management and security, IT professionals estimate that knowledge workers spend an average of 56% of their workday in a browser. The report also found that 92% of surveyed organizations allow employees to use public generative AI applications, much of which takes place through browser-based services.
This widespread adoption creates a new security challenge. Employees can interact with AI tools, upload documents, share information, and process business data through web applications without installing traditional desktop software. As a result, AI usage can introduce data exposure risks that are difficult to understand through conventional application inventories alone.
The report found that 92% of respondents were concerned about data leakage through unsanctioned AI applications or browsers. Only AI-powered phishing and social engineering, which concerned 95% of respondents, ranked higher among the emerging threats examined. Furthermore, among organizations that had experienced browser-related security incidents, data loss or leakage was the second most common incident type, reported by 38%, behind phishing at 40%.
These findings demonstrate why AI security deserves attention alongside other enterprise security priorities. Organizations need to understand how employees use AI and where sensitive information might be exposed before they can make informed decisions about appropriate safeguards.
The Visibility Gap Behind Shadow AI
Shadow AI refers to AI applications and services employees use without appropriate organizational awareness, approval, or governance. It can emerge when employees independently adopt tools to solve everyday problems, experiment with new capabilities, or improve existing workflows.
The challenge is that AI usage extends beyond applications formally installed and maintained by IT teams. Employees may access public AI assistants through browsers, experiment with locally running large language models (LLMs), or introduce automation platforms into their workflows.
The accompanying Omdia infographic on AI adoption and Shadow AI illustrates the gap between organizational oversight and employee behavior. It reports that 37% of corporate knowledge workers use unauthorized AI tools weekly or more frequently. Meanwhile, 45% of end users believe their coworkers share privileged, private, or confidential information with unsanctioned AI tools.
The infographic also highlights a gap in policy awareness. Although 72% of organizations reportedly have AI usage policies, only 44% of end users said they were aware of their organization's policy. This difference suggests that publishing rules is not enough; organizations also need to understand actual usage and ensure employees know which practices are permitted.
Traditional software inventories may not capture all these activities in one place. Even when organizations maintain accurate records of installed applications, they may lack visibility into browser-accessed AI services, locally available models, or AI capabilities embedded within other applications.
As explained in Google's research on securing AI in the browser, AI security requires organizations to consider how information moves through browser-based interactions, not simply which applications employees can access.
Why AI Discovery Is the First Step Toward Governance
Effective AI governance starts with understanding the environment that needs to be governed. Organizations need to know which AI technologies are present, how employees access them, and whether their use aligns with internal policies.
The Omdia report found that 59% of respondents identified generative AI application security as an important use case for secure browsing solutions, ahead of data loss prevention and data security at 51%, and general web security enhancement at 42%.
When asked about the most important attributes of a secure browsing solution, 57% prioritized integration with other security tools. Controls over generative AI application usage were identified by 53%, while centralized policy enforcement and data protection or DLP each received 52%.
These results point to a need for connected visibility and governance. Organizations must understand AI activity within their broader security environment and use that information to guide policies, investigations, and decisions.
A useful AI inventory should account for multiple forms of adoption, including:
Installed AI applications: Dedicated AI tools available on employee devices.
Browser-accessed AI: AI applications employees use through websites and browser sessions.
Local AI models: LLMs and related technologies running locally on endpoints.
AI workflow platforms: Automation tools that connect AI capabilities with business processes.
By considering these sources, organizations can move beyond a narrow view of AI adoption and establish a more informed starting point for governance.
Turning AI Visibility Into Informed Decisions With GRT
Understanding AI adoption across an organization requires more than manually maintained application lists. IT teams need a practical way to examine discovered AI technologies, identify usage patterns, and determine where further governance review may be necessary.
GRT AI Usage Insights helps organizations build this broader view by bringing together visibility into installed AI applications, browser-accessed AI, local models, and workflow platforms. Administrators can examine organization-level findings and investigate individual devices when additional context is needed.
The Report Generator also supports classifying identified AI technologies as Sanctioned or Unsanctioned, helping teams compare discovered usage with their governance decisions. This provides useful context for identifying applications that may require further review, without treating every unsanctioned tool as automatically malicious.
Learn more about the capability in Gain Better Visibility and Governance Over AI Usage With GRT AI Usage Insights.
Build AI Governance on a Clearer Picture of Usage
AI adoption brings measurable opportunities for organizations, from streamlining IT support to improving data analysis and automating repetitive tasks. The Omdia AI adoption infographic reports that 56% of organizations saw AI streamline IT support through assistant-led self-service, while 55% reported improvements in complex data analysis. These benefits make an outright rejection of AI an increasingly difficult long-term strategy.
The challenge is enabling those benefits while maintaining appropriate oversight. Research findings on unauthorized AI use and policy awareness demonstrate why organizations cannot rely on written policies or assumptions alone. They need visibility into their own environments to understand what employees are using and where governance gaps may exist.
Google Endpoints Readiness Tool supports this starting point through AI Usage Insights, helping IT and security teams build a clearer picture of AI adoption and make more informed governance decisions.
Effective AI governance begins with visibility. By understanding how AI is used across their environments, organizations can better balance innovation, productivity, and responsible use.
Explore Google Endpoints Readiness Tool to learn more.
Frequently Asked Questions
1. What is Shadow AI in an enterprise environment?
Shadow AI refers to AI applications and services employees use without appropriate organizational awareness, approval, or governance. It can include browser-based AI tools, locally running models, and automation platforms adopted outside established IT processes.
2. Why is AI usage visibility important?
AI usage visibility helps organizations understand which AI technologies are present and whether their use aligns with internal policies. It provides a foundation for identifying potential governance gaps and deciding where further review may be necessary.
3. What does GRT AI Usage Insights help organizations identify?
GRT AI Usage Insights provides visibility into installed AI applications, browser-accessed AI tools, local LLMs, and workflow automation platforms across assessed devices.
4. How does AI sanctioning support governance?
AI sanctioning allows administrators to classify identified AI technologies as Sanctioned or Unsanctioned according to organizational decisions. This helps teams identify technologies that may require review, although classification alone does not enforce access restrictions.
5. What does Omdia research reveal about Shadow AI?
The accompanying Omdia infographic reports that 37% of corporate knowledge workers use unauthorized AI tools weekly or more frequently. It also found that while 72% of organizations have AI usage policies, only 44% of end users said they were aware of those policies, highlighting a gap between policy creation and employee awareness.
