2026年AI应用与风险报告

Cyberhaven Labs Table ofContents Key Findings4 Section 1:An AI Adoption Gap is Emerging5 Section 2:Enterprise AI Usage Spans Models, Tools, andAccounts — Outpacing Governance7 Section 3:Regulated Industries Are Adopting AI Most Frequently12 Section 4:Employees Are Pouring Sensitive Data into Risky AI tools14 Section 5:Coding Assistants and AI Agents are BecomingThe “Second Wave” of Workplace AI16 Conclusion19 Introduction Since the launch of ChatGPT in 2022, AI has become one ofthe fastest-adopted workplace technologies in history. What began as individual employees experimentingwith generative AI has rapidly evolved into toolsembedded directly into core business workflowsacross organizations of all sizes. The speed of thistransition, from novelty to operational dependency,has been unprecedented. In many cases, it hasoutpaced the ability of enterprises to understand,govern, and secure AI usage. plateau, enterprise AI adoption is not slowing down.In 2025, AI coding assistants, browser-basedagents, and custom AI agents saw rapid growth.This second wave of adoption is more operationaland more automated. It is also far more difficult togovern. These tools operate inside developmentenvironments, browsers, and workflows. Theyinteract directly with sensitive data, proprietary code,and critical systems, often with limited oversight. AI adoption has not progressed evenly acrossthe enterprise. Usage is increasingly polarized. Asmall but growing set of organizations is movingaggressively, deploying dozens or even hundredsof AI tools across development, operations, andknowledge work. Others remain cautious or onlylightly engaged. In high-adoption environments,innovation often advances faster than governance.Experimentation frequently takes priority overvisibility, control, and risk management. As AI becomes infrastructure rather than astandalone interface, the security implicationsintensify. Employees are no longer using AI only forideation or research. They are inputting source code,financial data, customer information, and intellectualproperty across a fragmented and expandingecosystem of tools. Much of this activity occursoutside traditional IT visibility. It spans personalaccounts, open-weight models, and SaaS platformsthat lack enterprise-grade security controls. This year’s research fromCyberhaven Labs captures aclear shift in how enterprisesare using AI and where risk isconcentrating as a result. The result is a familiar pattern, amplified by scaleand speed. Shadow adoption increases. Controlsare applied inconsistently. Risk accumulates fasterthan most organizations can measure or manage it.The risks associated with enterprise AI use are nolonger theoretical or future-dated. They are alreadymaterial, unevenly distributed, and concentratedamong the organizations and teams adopting AImost aggressively. To understand the full scope of adoption, weanalyzed AI usage across three categories:Generative AI SaaS applications, endpoint AIapplications, and AI agents. Drawing on billionsof real-world data movements from hundredsof thousands of employees at a sample of 222companies, we measured adoption using activeuser counts and event-level activity. This approachallowed us to assess not just whether AI is present,but how deeply it is embedded into daily work. This report provides a data-driven view into howenterprises used AI in 2025, where adoptionis accelerating, and where security risk iscompounding. By examining real-world usagepatterns across industries, departments, tools, anddata types, Cyberhaven Labs aims to help securityand technology leaders understand not just the scaleof AI adoption, but the context required to govern itsafely as they plan for 2026. The data shows that while usage of traditionalchat-based GenAI SaaS tools is beginning to Key Findings 01Organizations with the highest rates of AIadoption are utilizingover 300GenAI toolswithin their enterprise environment. 02Chinese open-weight models are now enterprisefavorites, accounting for50%of endpoint-based usage among Cyberhaven users. 03GenAI tools remain risky across the board. When lookingat the top 100 most-used GenAI SaaS applications,82%are classified as “medium,” “high,” or “critical” risk. 04One-thirdof employees are accessingGenAI tools from personal accounts,increasing overall risk and Shadow AI. Employees are feeding AI tools sensitivedata, as over a third (39.7%) of all interactionswith AI tools involve sensitive data. An AI AdoptionGap is Emerging Artificial intelligence (AI) andlarge language models (LLMs) arebecoming increasingly embeddedin organizational workflows. Today, 62% of organizations1are experimenting with AI agents,enterprises are spending four times more on AI software thanon traditional software, and 74% of executives stated2theyachieve returns within the first year of AI tool deployment. However, AI adoption and useis not unfolding as a steady,industry-wide wave. Instead, it isbecoming increasingl