Sources & Methodology

Half of employees were using unapproved AI tools at work (October 2024)

“In October 2024, half of all employees were using unapproved AI tools.”

86% of organizations are blind to their AI data flows

“The 2025 State of Shadow AI Report from Reco found that 86% of organizations lack visibility into how data flows to and from AI tools. (Quoted verbatim by OffSec, who reviewed the Reco report.)”

48% of employees would continue using AI tools even if banned

“48% said they wouldn't stop even if banned.”

12% of practitioners report having no visibility into what employees enter into AI systems

“12% of practitioners admitted they had no visibility into what is being entered into AI systems within their organization.”

Average enterprise sees 223 sensitive-data policy violations involving generative AI applications per month

“The average organization now experiences 223 data policy violations involving generative AI applications every month. For organizations in the top quartile, that number jumps to 2,100 incidents monthly.”

Shadow AI breaches cost organizations $4.63M on average — $670K more than standard incidents

“Breaches involving shadow AI cost organizations $4.63 million on average—$670,000 more than standard incidents.”

80% of companies say their AI agents have taken unintended actions

“80% of companies say their AI agents have taken unintended actions.”

39% of organizations report AI agents accessed unauthorized systems; 33% report agents accessed inappropriate or sensitive data

“39% of respondents reported AI agents accessed unauthorized systems, while 33% said agents accessed inappropriate or sensitive data.”

53% of organizations have had AI agents exceed their intended permissions

“53% of organizations have had AI agents exceed their intended permissions, leaving them vulnerable to increased risk.”

Only 24.4% of organizations have full visibility into agent-to-agent (A2A) communication

“Only 24.4% of organizations report having full visibility into which AI agents are interacting with others (A2A communication).”

25.5% of deployed agents can both create and instruct other agents — establishing autonomous chains of command

“25.5% of deployed agents are capable of both creating and instructing other agents, effectively establishing autonomous "chains of command" that may bypass traditional human-centric authorization gates.”

100% of NVIDIA is using a combination of Claude Code, Codex, and Cursor

“100% of NVIDIA is using a combination of, or oftentimes all three of them, Claude Code, Codex, and Cursor.”

NVIDIA projects at least $1 trillion in AI infrastructure demand through 2027

“I see through 2027 at least $1 trillion. In fact, we are going to be short.”

EU AI Act fines: up to €35M or 7% of global annual revenue, whichever is higher

“Non-compliance with the prohibition of the AI practices referred to in Article 5 is subject to administrative fines of up to 35,000,000 EUR or, if the offender is an undertaking, up to 7% of its total worldwide annual turnover for the preceding financial year, whichever is higher.”

EU AI Act high-risk system obligations become applicable on August 2, 2026

“This Regulation shall apply from 2 August 2026 [in respect of high-risk AI systems and most other obligations].”

Colorado AI Act takes effect June 30, 2026 (delayed from February 1)

“The law was originally scheduled to apply beginning Feb. 1, 2026, but the law's effective date was subsequently pushed to June 30, 2026, during a special session last fall through Senate Bill 25B-004.”

Cisco acquired Robust Intelligence for ~$400M (October 2024). Officially announced; price not disclosed by Cisco; figure widely reported.

“Israeli Yaron Singer sold the startup he founded, Robust Intelligence, to communications giant Cisco for $400 million, according to reports in the U.S.”

Palo Alto Networks acquired Protect AI for $500M+ (announced April 2025, completed July 2025). Price not officially disclosed.

“Sources told GeekWire that the deal is worth more than $500 million.”

Check Point acquired Lakera for ~$300M (September 2025). Price not officially disclosed; figure widely reported.

“Check Point acquires Lakera in $300 million deal to expand AI security.”

F5 acquired CalypsoAI for $180M (announced September 11, 2025; completed September 30, 2025). Officially disclosed.

“F5 will acquire all issued and outstanding shares of CalypsoAI, a private company with major operations in Dublin, Ireland, for $180 million in purchase consideration financed primarily with cash.”