I spend a lot of time now in rooms where the AI question has moved from should we to how do we show it is working, and the governance conversation always arrives last. Procurement knows the shortlist, legal has the model-use policy half-written, and somewhere a line in a workforce survey confirms that the finance team is already pasting board minutes into a chatbot they paid for themselves. The programme that was going to catch all of this is still in draft.
For a buyer of our work, this is not an abstract risk. Shadow AI is the uncounted line on next year’s budget: the licences you are not paying for because employees are, the audit evidence you cannot produce because the tool is not on the asset register, and the breach narrative you would struggle to write because the data left through a browser tab nobody on the security team can see. The companies I would rather be building for in 2027 are the ones who treat this as a programme now, not a surprise later.
So this piece is not me shouting a position. I went and read what five named practitioners have published this year on where the enterprise shadow AI governance gap actually sits, and what they think closes it. Then I added what the recommendation looks like inside a real WordPress or WooCommerce estate, which is the half nobody else does.
The Five Voices in This Piece
- Ray Canzanese, Director, Netskope Threat Labs, on the Cloud and Threat Report 2026 (published 12 January 2026).
- Todd Larsen, President, Global Nexis Solutions, LexisNexis Legal & Professional, on the Future of Work Report 2026 (19 March 2026).
- Keith Bloomfield-DeWeese, Senior Manager, AI Product Development, ISACA, on the ISACA 2026 AI Pulse Poll (5 May 2026).
- Ulrika Dellrud, Chief Privacy and Data Ethics Officer at Smarter Contracts and member of the ISACA Emerging Trends Working Group, on the same ISACA release.
- Jared Spataro, Chief Marketing Officer, AI at Work, Microsoft, on the 2026 Work Trend Index (5 May 2026), reported by CIO Africa (12 May 2026).
Adoption Has Run Ahead of the Policy That Was Supposed to Catch It
The clearest finding across the five voices is simple arithmetic. More people are using generative AI inside the enterprise than are covered by any policy telling them how.
Bloomfield-DeWeese sets the shape of the gap. The ISACA 2026 AI Pulse Poll, drawn from more than 3,400 digital trust professionals, reports that 38 percent of organisations have a formal comprehensive AI policy, up from 28 percent in 2025. Thirty percent have a limited policy. A quarter have no active AI policy at all. Ninety percent of respondents believe their employees are using AI anyway. His quoted framing is useful because it refuses the easy win: “The organizations that resist the urge to declare victory too early are the ones most likely to get there.”
Larsen’s side of the picture is from the LexisNexis Future of Work Report 2026, 1,400 professionals across more than twenty industries. Fifty-three percent of professionals say they use generative AI without formal approval. Twenty-eight percent say their organisation has no formal policy. Fifty-five percent personally pay for the tools, and sixty percent of those payers use them at work. His own framing is characteristically flat: “Generative AI is now embedded in daily workflows across the enterprise. It demands reliable, authoritative data, clear governance, and human accountability.”
Read the two surveys next to each other and the position is not controversial. The policy exists on paper or it does not, and either way the workforce has already decided it does not apply to them.
Shadow AI Is Not a Technical Bypass, It Is a Work-around for a Missing Programme
Canzanese comes at it from the other side of the enterprise, which is the side that counts the incidents. The Netskope Cloud and Threat Report 2026, based on telemetry from October 2024 to October 2025, logs an average of 223 AI-related data policy violations per month per organisation. In the top quartile, that figure is 2,100 per month. Fifty-four percent of those incidents involve regulated data: personal, financial or healthcare records that should not have left the perimeter. Forty-seven percent of generative AI users still reach their tools through personal, unmanaged accounts. Personal apps are involved in six in ten insider threat incidents.
His read on what this means for a security function is worth quoting at length because the framing is what the policy conversation usually misses:
“Enterprise security teams exist in a constant state of change and new risks as organizations evolve and adversaries innovate. However, genAI adoption has shifted the goal posts. It represents a risk profile that has taken many teams by surprise in its scope and complexity, so much so that it feels like they are struggling to keep pace and losing sight of some security basics.”
Ray Canzanese, Director, Netskope Threat Labs, quoted in IT Pro, 12 January 2026
The useful part of Canzanese’s position for a buyer is the one that reframes shadow AI away from naughty employees. People use personal accounts because the enterprise tool is not provisioned, or is slow, or is locked to a use case that does not match the one they have. The violation count is the symptom. The missing programme is the condition.
The Leadership Deficit Is as Real as the Technology One
Dellrud, speaking in the ISACA release in her capacity on the Emerging Trends Working Group, puts it plainly: “the leadership deficit is as real as the technology one,” and “AI success will depend not just on innovation, but on disciplined governance.” The supporting figures from the same poll are the ones that should trouble a board: 39 percent of respondents do not know whether their organisation has a documented process for shutting down or overriding an AI system, and 56 percent do not know how long it would take to halt one after a security incident.
Spataro, in Microsoft’s 2026 Work Trend Index briefing based on a survey of 20,000 workers across ten countries, lands on the same point from the adoption side. “Frontier Firms are those that are deliberately designing workflows around AI to create long-term value,” he says, and “the real differentiator now is how organisations structure work around it.” The underlying number in his report is the one worth pinning to a slide: only 26 percent of AI users say their leadership is clearly and consistently aligned on AI. Sixty-five percent fear falling behind if they do not adopt quickly. Thirteen percent say they are rewarded for reinventing how they work.
What Dellrud and Spataro disagree on, usefully, is where to start. Dellrud’s argument is bottom-up: pin down the standards, the shutdown procedure, the accountability chain. Spataro’s is top-down: reshape the work itself before you reshape the controls. The honest answer is that most enterprises are doing neither, and the governance programme that works is the one that holds both.
Training Without Authority Is Not Training
This is the finding that would catch an audit committee off guard. Larsen’s survey asked the people who had been through mandatory AI training what they did next. Seventy-four percent of those who received mandatory AI training still reported unauthorised use of generative AI. Nineteen percent received no training at all. Sixty-four percent describe themselves as very or extremely confident in using generative AI responsibly, which is a confidence number nobody has earned yet. Fifty-one percent of organisations say they have launched internal AI agents, and only forty-four percent of employees clearly understand what those agents do.
Put the four voices together and the shadow AI governance gap takes a specific shape: a policy that does not fully exist, a workforce that uses the tools anyway through personal accounts, a leadership team that is not consistently aligned, and training programmes that do not change behaviour. None of the four is the whole explanation. All of them are measured.
What Closing the Gap Looks Like Inside a Real WordPress Estate
Every one of the recommendations above lands on an implementation layer somewhere. Here is where it lands on a WordPress or WooCommerce estate, which is the stack we build on. Treat this as the shortlist a reasonable mid-market or enterprise programme can ship over a quarter, not as a complete catalogue.
1. A sanctioned AI provider list, enforced at the key layer, not at the policy layer. If the policy says “approved providers only” and the enforcement is a line in a PDF, you are measuring intent. Centralise API key management in a secrets store the editorial and marketing team cannot bypass (we use environment-scoped keys on WordPress VIP, equivalent isolation on managed hosting), expose the AI capabilities to editors through a thin internal plugin that calls those keys server-side, and log every call. Two to three sprints on a mid-market estate.
2. A browser-side DLP posture that the editorial team actually experiences. The 223 violations per month figure in the Netskope report is measurable only because a tool was watching. The equivalent on a WordPress-centric estate is a CASB or endpoint posture that blocks or warns on paste into unapproved origins, scoped to the browsers that staff use to compose content. Procurement and deployment live outside WordPress, but the integration list, which origins are allowed, which are warn-and-log, which are blocked, is written by the editorial lead, not by security alone. One quarter end-to-end, including a two-week baseline before any blocking turns on.
3. A disclosure taxonomy on every piece of published content. This is a WordPress-native build and it is the one piece that gets neglected. Register a content_provenance taxonomy with terms for human-written, AI-assisted and AI-generated. Attach it to every content type that publishes. Expose it in the editor as a required field, with a publish-gate filter that refuses to let a post go public without it. Render it on the front end as a small, honest label. Four to six days of work on a block theme, and it carries the Larsen recommendation (“human accountability”) and the Dellrud recommendation (traceability) in one object.
4. A kill switch that is not just a Confluence page. Dellrud’s finding that 56 percent of respondents cannot say how long it would take to stop an AI system should be the one that lights the fire. On a WordPress estate this is a feature flag per capability (not per plugin), wired through wp_options or a feature-flag service, with a documented runbook that a shift lead can actually execute in under five minutes. Test it quarterly, with a timed drill, and keep the result. Half a sprint to build, standing cost thereafter.
5. A training programme measured by behaviour, not completion. Larsen’s 74 percent figure is the training programme failing in daylight. Replace the mandatory course that nobody remembers with a sanctioned-tool access workflow: enrolment is how an editor gets to use the approved AI capability at all. Behaviour change tracks against the DLP log and the content_provenance taxonomy. If staff were trained in Q2 and the unauthorised-paste count did not drop by Q3, the training was theatre and the budget line stops. The measurement is cheap once steps 2 and 3 are shipped.
Total effort, honestly scoped, is one quarter of focused work for a mid-market estate and two for a group with four or five brand sites running under a common governance layer. Budget this against the 2,100-violations-per-month top quartile Netskope figure, which is what the uncounted side of the ledger already costs you if you are an organisation at that scale.
What Is Still Unresolved
Two things, honestly. The first is that none of the five voices offers a convincing answer on agents acting across the boundary of the content system. The Netskope July 2026 follow-up calls out downstream policy violations, where an AI service returns data the user should not have reached, as its second-most-common enterprise AI violation. Nobody I have read this quarter has a settled governance pattern for that in production. We are watching it with interest and we do not have a confident recommendation yet.
The second is the measurement question, which Spataro’s own report refuses to resolve. If 65 percent of workers fear falling behind on AI, and only 13 percent say they are rewarded for reinventing how they work, the shadow AI governance programme can succeed at suppressing the incident count and still fail at capturing the value. That is a conversation for the board, not for the security team, and it is the conversation we would want to have before the next twelve months of budget cycles start setting it in stone. If that is the conversation your organisation is overdue, our WordPress VIP agency page is where it tends to start.
Last modified: October 28, 2026
