AI Hype Is Everywhere. AI Control Is Not.

Right now the AI conversation feels a little like the early cloud era mixed with SaaS sprawl and crypto-era hype all happening at once.

Everywhere you look there are memes about exploding token bills, reels about GPU shortages, screenshots of massive AI invoices, and startups proudly announcing they’ve made literally everything “AI-powered.” Employees are quietly expensing AI subscriptions, departments are experimenting independently, and new AI tools are appearing across organizations faster than IT can even inventory them.

Some of the humor is deserved because the spend is real. The experimentation is real. The chaos is real too.

But underneath all the hype, a much bigger operational problem is quietly forming inside enterprises:

AI is spreading faster than governance, architecture, procurement, cybersecurity, and finance teams can keep up with it.

That’s the real story beginning to emerge beneath the surface of the AI boom.

Shadow AI Is Becoming the New Shadow IT

A few years ago organizations worried about Shadow IT — employees spinning up SaaS apps, cloud workloads, and tools outside approved procurement or security processes.

Now we’re entering the era of Shadow AI.

And this problem is larger because AI systems do more than store data or automate workflows. They reason, make decisions, connect to APIs, access sensitive systems, and increasingly operate with delegated authority through agents and automations.

In many organizations today, nobody truly knows:

  • which AI tools employees are using
  • what browser extensions are installed
  • which APIs are connected into company systems
  • what data is flowing into external models
  • which autonomous workflows are operating
  • where token spend is accumulating

This is no longer just software sprawl.

It’s intelligence sprawl.

The AI Token Economy Is Already Spiraling

Jensen Huang and other AI leaders are probably right that society is going to spend extraordinary amounts of money on AI compute over the next decade.

But there’s an important distinction between hyperscaler economics and enterprise economics.

Most businesses eventually need operational efficiency.

Right now many organizations are using frontier reasoning models for nearly everything imaginable — even tasks that may not require that level of intelligence at all.

Need to summarize documents?
Use the largest reasoning model available.

Need lightweight workflow automation?
Use a frontier model.

Need internal ticket classification?
Throw premium tokens at it.

The industry is currently operating with a mentality that more AI automatically equals better outcomes.

But eventually operational reality shows up.

The CFO starts asking why token bills are exploding. Procurement starts asking how many AI vendors are actually being paid. CIOs begin questioning whether the organization is standardizing intelligently or simply accumulating AI sprawl at cloud speed.

That’s when enterprises begin entering the next phase of AI maturity:

rationalization.

Not Every Workflow Needs a Frontier Model

Frontier models like GPT-5.5 and Claude 4.7 are extraordinary technological achievements. They represent billions of dollars of training, elite reasoning capability, and some of the most advanced computational systems ever built.

But not every enterprise task requires MBA-level or PhD-level reasoning power.

A surprising amount of enterprise automation really comes down to repetitive operational tasks, lightweight reasoning, retrieval, routing, summarization, classification, and structured workflows.

That’s where smaller open-weight and local models become incredibly important.

Many organizations are beginning to realize that a large percentage of enterprise AI workloads can run perfectly well on:

  • smaller private models
  • constrained agents
  • lightweight open-weight AI
  • local inference systems
  • deterministic workflows

And often with dramatically lower cost, lower latency, improved privacy, reduced attack surface, and little or no recurring token spend.

The future enterprise AI architecture probably doesn’t become:
“One model to rule them all.”

It becomes:
“The right intelligence for the right task.”

Sometimes you genuinely need frontier reasoning.

Sometimes a smaller, cheaper, more controlled model is exactly the smarter business decision.

Why the CISO and CIO Suddenly Matter More Than Ever

This is where the role of cybersecurity and IT leadership starts changing dramatically.

Historically, many organizations viewed security teams as compliance enforcers or blockers. But AI changes the equation because somebody now has to help the organization answer questions that suddenly impact security, operations, procurement, finance, and governance simultaneously.

Questions like:

  • What AI is actually being used?
  • Which agents exist?
  • What models are connected?
  • What systems can those agents access?
  • What data is being exposed externally?
  • Which workloads truly require frontier models?
  • Where are costs spiraling unnecessarily?

This is no longer just a cybersecurity problem.

It’s an operational control problem.

And increasingly, the CIO and CISO organizations may become the only teams positioned to help the business scale AI sustainably and intelligently.

Not because they want to stop AI.

But because they may become critical to making enterprise AI economically viable, operationally safe, and governable over time.

The next generation of cybersecurity leadership may end up looking less like “Department of No” and more like enterprise AI optimization partners.

The Hidden Risk Nobody Talks About: Runtime AI Behavior

One of the least discussed realities of enterprise AI adoption is runtime execution risk.

Most conversations today are focused on prompts, copilots, benchmarks, and productivity gains.

But the more important operational question increasingly becomes:

“What are these agents actually doing once they’re running?”

Modern AI agents can access files, connect into SaaS platforms, call APIs, automate workflows, retrieve sensitive data, and execute actions autonomously.

Unlike traditional software, AI behavior can also be dynamic and probabilistic. That creates an entirely new runtime trust problem.

Eventually “AI being AI” stops being funny when:

  • sensitive data leaks
  • automations behave unpredictably
  • agents execute unintended actions
  • or workflows begin chaining together in unsafe ways

This is why runtime visibility and runtime control are becoming essential architectural requirements for enterprise AI adoption.

Not just governance policies sitting in slide decks.

Actual operational enforcement.

The Future Enterprise AI Strategy: Discover → Control → Enable

The organizations that mature successfully in AI will likely follow a very simple operational model:

First, discover what AI actually exists across the organization. You cannot control what you cannot see. That means building visibility into models, agents, APIs, browser usage, workflows, integrations, token consumption, and autonomous activity.

Second, control it. Not in the sense of killing innovation, but by introducing operational discipline around runtime behavior, permissions, model selection, data access, cost management, and execution boundaries. This is where organizations begin determining which workloads truly need frontier reasoning versus where open-weight or local models make far more sense operationally and financially.

Then finally, enable it safely at scale.

That’s the important part many people miss.

The goal is not to stop AI adoption.

The goal is to create enough visibility and control that organizations can confidently accelerate AI adoption without introducing uncontrolled spend, unnecessary attack surface, or operational chaos.

The Best Security Teams Won’t Kill AI — They’ll Optimize It

The smartest organizations are not going to ban AI.

That battle is already over.

Instead, they’re going to rationalize it, optimize it, inventory it, and align it with actual business value.

The future winners in enterprise AI will likely be organizations that understand:

  • where frontier reasoning truly matters
  • where smaller models are sufficient
  • how to reduce unnecessary complexity
  • how to manage runtime risk
  • and how to scale AI responsibly without letting operational entropy take over

That’s not anti-innovation.

That’s operational maturity.

A New Operational Layer for Enterprise AI

This is one of the reasons I’m personally excited about the emergence of a new category of enterprise AI operational platforms focused on visibility, runtime control, intelligent model orchestration, and safe enablement.

At RSAC San Francisco earlier this year, OmniTrust quietly debuted a new enterprise AI control plane designed around a simple operational philosophy:

Discover → Control → Enable.

The idea is straightforward:  help organizations discover Shadow AI and model sprawl, introduce runtime visibility and operational control, and then safely put AI agents into the hands of everyday knowledge workers without creating uncontrolled spend, unpredictable behavior, or unnecessary operational risk.

What’s particularly interesting is the ability to intelligently blend:

  • frontier models where elite reasoning is required
  • open-weight or local models where lower-cost controlled execution makes more sense
  • and governed agents operating within clear boundaries and permissions

In many ways, this feels like the beginning of the “adult supervision” phase of enterprise AI.

Not anti-AI.  Not anti-innovation.

Just operationally sustainable AI.

I suspect over the next 12–24 months we’ll see a major shift from:
“Who has the most AI?”

…to:
“Who can operationalize AI safely, intelligently, and economically at scale?”

AI adoption is accelerating faster than most enterprises can operationalize it.

That creates Shadow AI, uncontrolled agents, fragmented tooling, exploding token spend, runtime risk, unclear permissions, and rapidly expanding attack surfaces.

The organizations that thrive in the next phase of AI adoption will not simply be the ones using the most AI.

They’ll be the ones that:

  • understand it
  • inventory it
  • control it
  • optimize it
  • and safely enable it across the enterprise

Because AI is already being used.

But in many organizations…it still isn’t being controlled.