Photo By: Sanjeevan SatheesKumar
Companies are using artificial intelligence faster than they are figuring out how to keep it safe. And the cost of mistakes is already reaching millions of dollars.
Artificial intelligence, or AI, is quickly becoming a normal part of business.
Companies are using AI to write emails, answer customer questions, analyze information, create computer code and help employees get more work done. Some companies are also using AI to make decisions and complete tasks without a person doing every step.
That sounds exciting, and it can be.
But there is a problem:
Companies are adopting AI faster than they are creating rules to control it.
And that problem is already costing businesses a lot of money.
A recent survey of 300 enterprise decision-makers found that more than 40% said AI-related incidents cost their organizations $2 million or more during the previous year. The survey also found that 86% of respondents had investigated at least one AI-related security or operational incident during that time.
Those numbers show that AI security isn’t just a future concern. Companies are already paying the price when things go wrong.
Employees are already using AI
Many companies have official AI tools that employees are allowed to use. But employees are also finding and using AI tools on their own.
Someone might use an online AI chatbot to summarize a report. Another employee might use AI to write computer code. Someone else might use an AI tool to organize information from company documents.
The company’s IT or security team may not even know these tools are being used.
This is sometimes called “shadow AI.”
Imagine a school where students bring their own computers and connect them to the school’s network without telling the technology department. The school would have a hard time protecting its network if it didn’t know which computers were connected.
Companies face a similar problem with AI.
An employee might accidentally put private company information into an AI tool. The employee may not realize that the information could be stored, processed or exposed in ways the company didn’t approve.
AI agents create a bigger challenge
The situation becomes even more complicated with a newer type of AI called an AI agent.
Traditional AI tools usually wait for a person to ask a question. An AI agent can be given a goal and then take several steps to accomplish it.
For example, a company could give an AI agent access to its customer database and tell it:
“Find customers who haven’t purchased anything in six months and send them an email.”
The AI could search the database, find the customers and send the messages without a person completing each step.
That could save employees a lot of time.
But what happens if the AI makes a mistake?
What if it sends the email to the wrong people? What if it looks at information it shouldn’t have access to? What if someone gives it a bad instruction?
And who is responsible if the AI causes a problem?
These are questions businesses are still trying to answer.
The survey shows just how worried companies are becoming. 91% of respondents said they were concerned that AI agents are increasing their organization’s financial risk.
The biggest problem may be visibility
One of the biggest challenges isn’t even stopping bad AI behavior.
It is knowing where AI is being used in the first place.
A large company could have hundreds or thousands of employees using different AI tools. Some may be approved by the company. Others may not be.
Some AI systems might have access to company documents. Others could be connected to customer information, financial systems or computer networks.
If the security team doesn’t know an AI system exists, it becomes very difficult to protect it.
It’s like trying to lock every door in a building when you don’t know how many doors the building has.
The survey found a surprising example of this problem: 47% of respondents said IT and infrastructure departments were the biggest source of shadow AI. In other words, the people who are often responsible for managing technology are also among the biggest users of AI outside official company rules.
Companies can’t simply ban AI
It might seem like the easiest solution would be to tell employees:
“Don’t use AI.”
But that probably isn’t realistic.
AI can help people save time and get more work done. Companies also don’t want to fall behind competitors that are using the technology.
Worker access to AI increased by 50% in 2025, according to Deloitte, showing just how quickly the technology is spreading through businesses.
Instead, businesses need to figure out how to use AI safely.
That means creating clear rules about which AI tools employees can use, what information those tools can access and what they are allowed to do.
Companies also need to monitor their AI systems so they can see what is happening when something goes wrong.
AI needs rules, just like people do
Think about a new employee starting at a company.
That employee doesn’t automatically get the keys to every room in the building. They receive access to the information and systems they need to do their job.
AI should work the same way.
If an AI system only needs access to customer names, it shouldn’t also have access to the company’s financial records.
If an AI system can send emails, there should be rules about when it can send them.
And if an AI system is about to make an important decision, a human may need to check its work first.
These rules can help companies get the benefits of AI without giving the technology unlimited power.
Frank Palermo, COO of NewRocket, has argued that companies need to embed AI into their workflows and governance structures rather than treating it as a collection of separate experiments. The idea is that businesses need to figure out not only what AI can do, but also how it fits into the way the organization actually works.
That may be one of the most important changes companies need to make. AI governance can’t exist as a set of rules sitting in a document somewhere. It has to become part of how AI is introduced, used and monitored every day.
The cost of getting it wrong
The $2 million figure is important because it changes the conversation around AI security.
This isn’t simply a question of whether AI might cause problems someday.
Companies are already reporting expensive AI-related incidents.
For more than 40% of the organizations surveyed, those incidents cost at least $2 million over the previous year.
That could include the cost of investigating an incident, fixing security problems, dealing with lost information or recovering from an operational mistake.
There can also be costs that are harder to measure.
If customers lose trust in a company because their information was mishandled, that damage can last much longer than the original incident.
That’s why AI security isn’t just a technology problem. It is a business problem.
The goal isn’t to stop AI
AI isn’t going away.
Companies are going to keep using it, and AI will probably become even more important in the future.
The challenge is making sure companies don’t move so quickly that they forget about safety.
The companies that figure this out could have a big advantage. They will be able to use AI to move faster and get more done while still protecting their customers, employees and information.
The big question isn’t just:
“How fast can we adopt AI?”
It is also:
“How do we make sure the AI we use is safe and under control?”
Companies are already spending millions dealing with what happens when that answer isn’t clear.
The AI race has already started.
Now companies need to build the rules of the road.
