The UnmanagedMajority
What 1.7 Million AI Interactions Reveal About Enterprise Control
Nearly 1.7 million
AI interactions across 40 organisations · Q2 to Q3 2026
Employees have adopted AI. That argument is over. What matters now is what the use actually looks like: which applications people reach for, which accounts those run through, and what kinds of information they receive.
Built on anonymised, aggregated data from the CultureAI platform.
Join the waitlist
Methodology
Drawn from anonymised, aggregated data across 40 organisations over six months spanning Q2 and Q3 2026.
1,668,999
prompts
161,599
file uploads
1,064
AI applications
40
organisations
252,480
sensitive data detections
Q2 to Q3 2026
time period
What we looked at
Most research into AI usage asks people what they do. This study measures what was actually done.
Which applications people used.
Approved platforms, AI built into everyday business software, and the long tail that rarely reaches an inventory.
Which accounts they ran through.
Whether an interaction sat inside the enterprise agreement, or outside it on an account the organisation does not control.
What was shared with them.
Exposure depends on what is typed, pasted and uploaded, not on the name of the tool.
What the data showed
Four of the findings the report sets out in full, with the underlying data.
01
Every organisation's AI estate is different.
Around 113 AI applications turned up in the average organisation, and nearly half of those found across the study appeared in only one.
02
Enterprise account use is the exception.
Roughly four in five interactions ran through accounts the organisation does not control.
03
Sensitive information disclosures are routine.
Roughly one prompt in seven carried a sensitive disclosure, spread across a hundred different types of information.
04
The quiet categories dominate.
Credentials are the exposure most people think of first, but much of the risk also sits in strategic, financial, HR, health and legal information, which pattern-based tooling is far less able to recognise.
payments webhook is returning 401, fix using API key EXAMPLE_KEY_0000_NOT_A_REAL_SECRET
summarise the attached grievance file for the ops team lead
from the Q3 board pack, summarise our revenue figure total of £4.2m
find information on client Helen Thomas, address: 63 Chalfont St, London, W2 6CV
AI adoption is already established and widespread. Enterprise control is not.
Research written byOliver SimonnetLead Cybersecurity Researcher at CultureAIWho it is for
Security, IT and privacy leaders who have stopped arguing about whether to allow AI and started working out how to allow it safely.
If you are being asked for AI assurance by a board, an auditor or a regulator, this is your evidence base.
Be first to read it
Join the waitlist and it reaches you first.
Join the waitlist