Key Insights
Bringing AI Governance to the World
Starting today, AI Governance is generally available as a standalone product. New customers can purchase it without Inbound Email Security, and existing customers can still activate it from the Abnormal AI App Store. Additional products, including Inbound Email Security, Identity Threat Protection, and Infiltration Prevention, can be added at any time on the same platform.
That means there are now two ways to bring our Behavioral Security Platform into your organization: through AI Governance or through Inbound Email Security. From either starting point, you can expand laterally to Infiltration Prevention, Identity Threat Protection, and the other problems we continue to solve, all on the same behavioral model.
As you move through your AI security journey, the most pressing questions are the most basic ones. What AI is running, is it affecting your compliance, and how much is it costing you? AI Governance answers all three with nothing new to deploy, because it turns on in minutes in read-only mode by connecting to Microsoft 365 through the Graph API or to Google Workspace.
From there, you get visibility, prioritization, and remediation to:
Eliminate shadow AI by discovering every AI tool in use and acting on the ones that were never approved.
Inventory every AI agent across connected platforms, audit the access each one holds, and flag the dormant, orphaned, or overprivileged agents that still reach your systems.
Assess sensitive data shared in LLM-powered chat tools, including data in uploaded files and images, and map findings to compliance frameworks.
Understand AI costs, both the subscriptions your finance team knows about and the spend nobody added up.
What Early Trials Are Uncovering
Our existing customers have had access to AI Governance since we launched it at Black Hat this year.
Across trials, two of every three AI tools in use had never been approved, and in two recent trials the share reached nearly 90%1. One marine engineering firm found an enterprise ChatGPT application that had been running for about two years without the identity team's knowledge.
Agents are where the gap is widest. At one airline, 626 of 733 AI agents were dormant and still held key permissions, and a biopharma company that considered itself a Copilot shop found 157 Copilot Studio agents running on that one platform. Each of those agents is an identity with access to company data, and none of them went through the onboarding and offboarding every employee does.
The sensitive data findings are the kind that start incidents. At an electrical and infrastructure contractor, an employee uploaded a photo of a meeting whiteboard to an AI chatbot, and the corporate Wi-Fi password was written on the side of it. Other trials found a password inside an uploaded file and a working private key pasted into a chat, the kind of exposure no pattern rule was built to catch.
Spend tells a similar story. One software company found $289K in AI spend in invoice emails, more on sales and marketing AI than on its engineers. That spend carries two risks: consumption pricing lets bills grow outside IT’s view, and tools bought on personal cards have no enterprise terms governing how your data is kept or whether it trains the vendor’s models.
AI Governance closes the gap between what’s approved and what’s running, and every organization needs that gap closed today.
The Foundation for Our AI Security Portfolio
AI Governance is the foundation of the AI Security portfolio we recently announced2. You can’t secure an agent you don’t know exists, protect data you can’t see leaving, or control spend nobody has added up.
Visibility is where AI security starts, and behavior is what keeps it working as everything changes. When AI-generated attacks first hit email, the tools built to recognize known bad missed them, and what worked was learning normal and acting on the deviation. AI security is the same problem at a larger scale, with tools, agents, and attacks that will keep changing faster than any list can follow. The organizations that baseline normal now will be ready for whatever arrives next.
You can get started with AI Governance in minutes here.
Get Started With AI Governance
AI Governance trial data, August to October 2026. Customers anonymized.