Deloitte, BCG, and Verizon data show enterprise AI adoption is outpacing both cost controls and security oversight. 60 per cent report minimal or no return. 80 per cent of employees use AI tools their organisations have never approved. The average breach cost when those tools are finally discovered: USD 4.63 million.
Enterprise AI spending is at record levels. Companies plan to allocate 1.7 per cent of revenue to AI in 2026, more than double 2025 levels, according to BCG. Gartner forecasts 40 per cent of enterprise applications will embed AI agents by end of 2026, up from less than 5 per cent in 2025. Deloitte’s survey of 3,235 senior leaders found 91 per cent plan to increase AI investment again this year.
The spending is accelerating. The visibility is not.
BCG research shows 60 per cent of enterprises report minimal or no value from AI investments — and a significant driver is that most cannot see what they are spending. BenchmarkIT shows 80 to 85 per cent of enterprises miss AI cost forecasts by more than 25 per cent. Without visibility into which tools are consuming budget and which AI is even running, cost control is impossible before it starts.
At the same time, a parallel risk is growing unchecked. Verizon’s 2026 DBIR found over 80 per cent of employees use AI tools never approved or declared to IT — known as Shadow AI. These tools sit outside every governance framework the organisation has built. The median time to detect a Shadow AI breach is 247 days. The average cost on discovery: USD 4.63 million. CrowdStrike found Ghost AI added USD 670,000 to average breach costs, with AI-driven insider negligence costing USD 10.3 million annually.
Enterprises now face two gaps simultaneously: they cannot account for what AI is costing them, and they cannot see the AI creating risk inside their own perimeter.
The average enterprise hosts over 1,200 unofficial AI applications, many processing sensitive data on consumer plans that feed public models. GitHub found 39 million secrets — API keys, credentials, tokens — leaked across public repositories in 2024, accelerated by AI coding assistants most organisations cannot see.
Veranthios addresses all three — cost, risk, and exposure. The platform discovers AI tools operating across an enterprise — approved or not — governs the exposure each creates, attributes cost by team and tool in real time, and maps compliance evidence across 12 frameworks including IMDA AI Verify, MAS FEAT, ISO/IEC 42001, and the EU AI Act. Board-ready evidence packs are generated in 60 seconds.
As enterprises adopt Agentic AI, Veranthios is built to govern it at the protocol layer (MCP, A2A) to help standardise what each agent, its connections, and its multi-agent topology are actually doing – going beyond the identity-layer checks most governance tools stop at proving every compliance claim with cryptographically tamper-evident evidence rather than mutable logs.
“The enterprises generating returns from AI are those that govern all of it — not just what they know about. Cost without visibility is waste. Risk without visibility is exposure. Most enterprises today have both,” said the Veranthios spokesperson, bringing over 40 years of combined experience in enterprise AI and risk roles at Prudential, Barclays, Citibank, and Intel across Asia Pacific.
Veranthios based in Singapore with offices in Hong Kong, Jakarta and Tokyo is available now to enterprises across the World. Contact info@veranthios.com to arrange an initial assessment. www.veranthios.com
About Veranthios Pte Ltd
About Veranthios Veranthios is an AI Governance and Exposure Management Platform purpose-built for regulated enterprises across Asia Pacific, with native compliance coverage for IMDA AI Verify, MAS FEAT, ISO/IEC 42001, EU AI Act, OJK, and Japan METI/FSA. Media Contact: info@veranthios.com · veranthios.com · Singapore · Jakarta · Hong Kong · Tokyo Sources: Deloitte State of AI in the Enterprise 2026 · BCG Are You Generating Value from AI 2025 · IBM CEO Study 2025 · Gartner AI Agent Forecasts 2025–2026 · BenchmarkIT State of AI Cost Governance 2026 · Verizon DBIR 2026 · CrowdStrike Global Threat Report 2026
This press release has also been published on VRITIMES