Companies are increasing their cybersecurity budgets, with AI security and governance the top priority for additional spending, followed by cloud security, according to DNSFilter’s The Cost of Shadow AI report.

Some 74.5% of respondents reported a larger cybersecurity budget than 12 months earlier. Asked where their next incremental security dollar would go, 40.3% named AI security and governance, followed by cloud security at 25.5%.

One reason to prioritize it is that employees grant AI tools access to corporate systems before notifying IT, or without notifying IT at all. In organizations where employees use AI tools for work, 36.8% allow employees to grant access and notify IT afterward, while 6.5% provide no notification.

“In too many companies, the decision to connect an AI tool to corporate data is being made by someone who doesn’t own the risk. Closing that gap has to be the focus of the next round of spending,” said Ken Carnesi, CEO of DNSFilter.

Gaps in AI oversight

61.5% of respondents cannot say that every security tool in their environment is properly configured, while 61.8% cannot say that every tool is actively monitored.

Controls intended to detect shadow AI are already in place at many organizations, and they use AI governance or monitoring controls to identify incidents involving third-party AI tools.

shadow AI cost

Overall, 46.1% said an employee had connected an unapproved AI tool to their Google Workspace, Microsoft 365, or SSO environment, and 20.1% said one of those connections caused a security incident.

54% of respondents worry that their organization has significant AI costs that procurement, software asset management, and security monitoring teams cannot track. That figure rises to 58.8% for IT managers.

Those who approve budgets are the least concerned about spending they cannot track. Practitioners know AI tools have been purchased but cannot see the details.

Network activity exceeds reported AI use

Asked how many AI tools employees use for work, 55.3% of respondents said three to five, while just 0.5% said more than 10.

In August 2026, DNSFilter processed 3.4 billion requests to generative AI tools from more than 43,000 organizations across North America. Measurements taken across two business days that month showed that the typical organization connected to five distinct AI vendors, while 15.2% connected to more than 10. That is approximately 30 times the rate reported by IT professionals.

Only 0.75% of those generative AI requests were blocked, raising questions about whether organizations are exercising the control their governance spending was intended to provide. Allowing AI can, however, be a deliberate policy choice.

“Unfortunately, what organizations self-report and what we see on those networks are often two very different numbers,” said Kasey Best, Vice President of Threat Research at DNSFilter.