Shadow AI hit 1 firm in 5. Map it.

AI security spending grows about twice as fast as AI spending overall. Gartner's September 2026 spending forecast puts AI cybersecurity spending at US$25.9bn in 2025, US$51.3bn in 2026 and US$86.0bn in 2027. That is nearly double in one year. IT and security teams buy AI for two reasons at once: to defend with it, and to defend against the AI their own organisation already runs.

The second reason is the newer one, and the Global Market Study 2026/27 names it as the business problem of this area: shadow AI and agent sprawl.

Shadow AI is now a breach cause

IBM's Cost of a Data Breach Report 2025 put numbers on what security leaders suspected. One in five organisations in the study reported a breach due to shadow AI: AI tools used without approval or oversight. Where shadow AI was high, it added US$670,000 to the cost of a breach compared with low or no shadow AI.

The AI systems themselves are targets too. 13% of organisations reported breaches of AI models or applications. Of those, 97% said they had no AI access controls in place. And 63% of breached organisations either had no AI governance policy or were still developing one.

97%. Organisations with a breach of an AI model or application that had no AI access controls in place (IBM, Jul 2025).

These are not exotic attacks. They are the ordinary failures of unmanaged software: nobody knows the tool is there, nobody set permissions, nobody owns it. The difference is that AI tools read and write large amounts of company data by design.

AI also pays in security operations

The same report shows the other side. Organisations that used AI and automation extensively in security operations saved an average of US$1.9m per breach and shortened the breach lifecycle by 80 days. The global average cost of a breach fell to US$4.44m, the first decline in five years, while the US average reached a record US$10.22m.

Survey data points the same way. In the McKinsey State of AI 2025, respondents most commonly reported cost benefits from AI in software engineering, manufacturing and IT, and named IT, with service-desk management, as one of the two functions where agents are used most. The August 2026 edition confirms that organisations scale agents most often in IT, knowledge management and software engineering.

So IT is both an early winner and the place where uncontrolled AI piles up. The task is to keep the first and remove the second.

80 days shorter breach lifecycle where AI and automation were used extensively in security operations, saving US$1.9m per breach on average (IBM, Jul 2025).

Agents multiply the inventory problem

An inventory of AI tools was hard enough when the tools were chat windows. Agents act: they call systems, move data and trigger workflows. Gartner's June 2025 forecast expects 33% of enterprise software applications to include agentic AI by 2028, up from under 1% in 2024. Every one of those features is a potential new actor on your network.

Dependencies make it harder still. The Good AI Prism's verified relations show many applications resting on a few hubs: Zendesk, Salesforce and the Model Context Protocol on the application side, and OpenAI, Anthropic, Amazon Bedrock and Hugging Face underneath. A change or incident at one hub can reach many products at once. ETHORITY's insight Inventories list agents. They don't govern them. explains why a list alone is not enough: control needs authority, evidence state, data boundaries and change detection at runtime.

What the Prism shows about this area

The Good AI Prism places 27 AI offerings in IT & Security Operations, from AI-assisted security operations to IT service management and code security. Two code-security offerings profiled in the Software Development cohort show the facts a security buyer needs.

Exhibit: what a security buyer can already check on two registry cards

Source: Good AI Prism Registry, provider pages read 20 Oct 2026.

The Snyk DeepCode AI card and the SonarQube AI CodeFix card show why sourced facts matter in security: the same certification pair and different data locations. The registry records each statement with its source page, read date and evidence class.

Best practice. Pair every ban with a sanctioned alternative and a request route for new tools. Then report the shadow-AI share each month, next to incidents and mean time to resolve, so the policy is judged by what it changes.

The rules add dates

In Europe, the AI Act turns inventory into a duty with deadlines. Under Regulation (EU) 2026/1744, Article 50 transparency duties apply since 2 Aug 2026; high-risk duties for Annex III uses apply from 2 Dec 2027, and for high-risk AI in regulated products from 2 Aug 2028. A security team cannot classify risks for systems it does not know about. The ETHORITY insight AI Act readiness is not operational control shows how to connect each obligation to systems, controls and evidence.

Measure what matters

The study names three outcomes for this area: mean time to resolve, incidents, and the share of AI use that is shadow AI. The first two are standard IT metrics. The third is new, and it is the one most organisations cannot yet report. It is also the one IBM links to breach costs.

Cost belongs in the same report. The Global Market Study records that only 26% of large US firms see their AI costs in real time (KPMG AI Pulse, Q2 2026), and only 21% of organisations have mature agent governance (Deloitte). Security AI is often billed by data volume, events or usage. Without cost per detection or cost per resolved incident, a team cannot tell whether a new AI capability replaced work or simply added a bill. Put the cost line next to the three outcome measures from the first month of any pilot, and review all four together.

What to do Monday

1. Find the AI already in use. Combine expense reports, SSO logs, browser-extension inventories and network traffic to list AI tools and agents. Record owner, data touched and permissions.
2. Set access controls on every AI system you keep. IBM's 97% finding shows this is the most common gap.
3. Map dependencies. For each AI system, record the model, cloud and integration hubs it relies on, so one supplier incident does not surprise you.
4. Publish a shadow-AI policy with an approved alternative. A ban without a sanctioned tool moves usage out of sight.
5. Start reporting the shadow-AI share. Track it next to incidents and mean time to resolve. The AI Estate Audit & Mapping service builds this inventory and dependency map in one engagement.

The Good AI Prism keeps every registry fact sourced and dated, so a security shortlist can start from evidence rather than from a vendor deck.