By Alexis Porter, Content Marketing Manager at BigID. BigID was a finalist in the ‘Best Data-driven SaaS Innovation‘ category at The 2025 SaaS Awards, and a finalist in the ‘Best Cloud Data Management Solution‘ category at The 2024/25 Cloud Awards.

AI is no longer a technology on the horizon.

It’s already deeply embedded in our everyday life, from AI helping us improve our emails to Agentic AI being the first responder that customers reach out to for help. The latest report from tech analyst Mary Meeker paints a vivid picture of just how far and fast the AI boom has gone.

But behind the headlines and the optimism lies an uncomfortable truth: most organizations are dangerously unprepared for the very real risks that come with this wave of innovation.

Meeker’s 2025 trends report shows AI adoption is accelerating at an unprecedented pace. ChatGPT reached 800 million users by April 2025 and was handling over 365 billion searches annually. The cost to run and deploy AI is plummeting. Companies across the globe are racing to build, integrate, and monetize AI solutions, fueled by increased investment and a flood of new tools.

Yet this gold rush is outpacing many companies’ ability to secure what they’re building. They are effectively adding rocket fuel to their operations without double-checking if the safety systems can handle the speed.

AI is accessible, but often unmanaged

As Meeker points out, AI is becoming cheaper and more commoditized. Open-source models and API-based services make it easy for developers and teams to experiment with generative AI on their own. While accessibility to AI spurs on innovation, it also means AI is often being used without centralized oversight or clear guidelines.

That’s where things get risky.

According to a recent AI Risk & Readiness survey of security and data leaders, only 6% of organizations say they have a mature AI security strategy in place. Nearly half have no AI-specific controls. And most worryingly, 64% report that they don’t have full visibility into where or how AI is being used within their organization.

While this new accessibility accelerates creativity, it also means that AI is often being deployed with little or no oversight. Many organizations still lack clear guidelines for how AI tools should be used, what data they can process, or who can access what. The result is an ever-expanding web of AI tools running in the shadows.

In short: AI is everywhere, but governance is missing.

The rise of shadow AI

You might remember the early days of shadow IT, when employees brought in their own devices and apps to get work done faster. Security teams spent years trying to rein it in. Now, the same pattern is repeating itself with AI.

This gap is giving rise to what some are calling “Shadow AI,” aka the use of AI tools and models without IT or security approval. Just like shadow IT before it, Shadow AI introduces serious vulnerabilities. Employees may use generative AI to analyze sensitive data, generate code, or create customer-facing content without knowing where the data goes or how it’s stored.

When AI systems operate outside the lines, it becomes nearly impossible for organizations to ensure compliance, protect data, or even detect errors.

In the AI risk and readiness survey mentioned previously, nearly 70% of organizations listed AI-powered data leaks as their top concern. And yet most still lack real-time monitoring for AI-related risks.

If you don’t know where AI lives in your business, you can’t secure it. You can’t ensure compliance. You can’t catch errors before they cause harm. And you certainly can’t promise customers their data is safe.

Compliance is struggling to keep up

Alongside the security risks is another mounting challenge: regulation.

Governments around the world are moving quickly to create guardrails for AI. The EU AI Act has already passed. U.S. states like California are drafting their own frameworks. And industry-specific regulations in healthcare, finance, and beyond are starting to address AI explicitly.

But most enterprises aren’t ready. The same survey found that 55% of organizations are unprepared to meet current or upcoming AI compliance requirements. That puts them at risk of penalties, lawsuits, and reputational damage.

Even sectors that have traditionally been more risk-aware are struggling. Only 38% of financial institutions surveyed had AI-specific data protection strategies. In healthcare, over half said that complying with AI regulations was a major hurdle. And nearly half of retailers had no visibility into how AI tools interact with customer data.

Building AI governance into the foundation

Meeker’s report makes it clear that AI will continue to reshape industries across the board. But without a parallel investment in governance, companies may end up building innovation on a shaky foundation. What’s needed isn’t a slowdown but smarter adoption.

That starts with visibility. You can’t manage what you can’t see. Organizations need clear inventories of what AI tools they’re using, where they live, and who has access to them.

Next comes policy. Companies should develop AI usage guidelines that spell out how AI can and can’t be used, what data it can touch, and who is responsible for monitoring its outputs. These policies shouldn’t live in a PDF that gets filed away. They need to be embedded into everyday workflows and backed up with training.

Real-time risk monitoring is another must-have. Just as companies have invested in tools to monitor their cloud and endpoint security, they now need controls that detect unusual AI activity, flag data exfiltration attempts, and help respond to incidents quickly.

Companies should also align their AI security and compliance strategies with evolving regulations through a comprehensive AI TRiSM (Trust, Risk, and Security Management) approach

Crucially, AI security and compliance shouldn’t live in silos. Governance has to be cross-functional, connecting legal, data, IT, and business teams. And it should be adaptable. Regulations are changing fast. So are the tools. The governance frameworks need to keep up.

The bottom line

Mary Meeker’s report captures the scale of the opportunity. AI is transforming how we work, communicate, and build. But the risks aren’t keeping pace with the rewards. Most organizations don’t have the visibility, controls, or strategies to manage the downside of this transformation.

It’s not too late to course-correct. But it requires shifting the focus from just what AI can do, to how we use it responsibly.

The companies that get this right won’t just avoid risk. They’ll be the ones leading the way forward.