Share with your CISO
KPMG Ireland is making a pointed case that AI risk inside enterprise organizations has already outpaced the governance frameworks meant to contain it. The core argument, drawn from their AI risk and cyber security analysis, is that the danger isn’t technical misconfiguration, it’s the behavioral gap between how employees are actually using embedded AI tools and what leadership believes is happening. That gap is widening precisely because AI arrived inside productivity software quietly, without explicit IT deployment decisions triggering the usual oversight processes.
What this means for your business
If your organization runs Microsoft 365 Copilot, Google Workspace AI features, or Salesforce Einstein, your employees are already experimenting with AI whether or not your security team has formally assessed it. The KPMG framing cuts to the relevant fault line for any CISO: the threat surface expanded not through a vendor decision you approved, but through a software update you didn’t block. Organizations that still treat AI risk as a procurement or architecture problem are measuring the wrong thing.
The behavioral risk argument is correct, and it’s also the argument KPMG’s advisory practice is best positioned to sell into, which creates a specific tilt worth noting. The piece stops well short of saying “deploy more monitoring software” and instead gestures toward governance redesign, a framing that naturally opens the door to consulting engagements rather than point solutions. That incentive doesn’t make the underlying diagnosis wrong. The pattern it describes, call it shadow AI adoption, where productivity tooling embeds model capabilities faster than policy can follow, is real and well-documented across regulated industries. What KPMG underplays is that behavioral risk is also the hardest kind to close through governance frameworks alone.
The CISO who should feel most exposed here isn’t the one running a laggard organization. It’s the one at a company that aggressively pushed Microsoft 365 Copilot or similar tools to drive productivity gains, got credit for the rollout, and now owns the liability if sensitive data surfaces in a model output or an audit reveals ungoverned usage patterns. The governance gap that’s widening isn’t a future problem to schedule. It’s the distance between what your last board AI update claimed and what your employees did this morning.
Based on reporting from AI, risk and cyber security, originally published 2026-07-04 03:00:00.
