The emergence of AI agents in enterprise environments has created a governance gap, putting organizations at risk of losing track of their digital workforce. As autonomous agents are integrated into operational roles faster than security measures can keep up, firms struggle to manage their expanding security perimeter.
Greg Kras, chief product officer at KnowBe4 Inc., expressed this concern during a recent discussion at KB4-CON 2026. He highlighted that the challenge now extends beyond traditional security protocols to include the complexities introduced by AI agents. “The fact that agents can beget agents — it becomes very interesting,” Kras remarked. Unlike human employees, who can be easily accounted for, AI agents can autonomously create additional agents or interact with external systems that may not align with organizational goals.
The Shadow AI Problem
Kras further emphasized the issue of shadow AI, where organizations lack visibility into the various AI applications being utilized across teams. He posed a critical question: “How many different AI applications does your organization use?” His response pointed to a common oversight: while companies may believe they are only using one or two solutions, the reality often reveals a dozen or more unaccounted applications. This invisible exposure complicates efforts to measure and mitigate risks associated with these tools.
In response to these challenges, KnowBe4 has transformed its platform over the past decade from focusing solely on simulated phishing and security awareness training to a comprehensive human risk management platform that also addresses AI governance. The company’s latest initiative, AIDA Orchestration, launched in Q1 2026, represents a proactive step toward managing this emerging risk landscape.
AIDA Orchestration: A Step Forward
AIDA Orchestration is designed to autonomously create, schedule, and personalize phishing simulations and security training at an individual user level. Early adopters of this system have reported a notable reduction in risk scores, with customers experiencing approximately a 15% decrease in their risk levels, according to Kras. This approach reduces the manual effort typically associated with traditional security training programs, allowing organizations to tailor their training to the specific needs of their workforce.
https://www.youtube.com/watch?v=xZSOploirr0
Kras noted that knowing one’s colleagues is inherently limited: “I don’t care how good you are with your coworkers or your employees, you don’t know them all.” AIDA Orchestration addresses this gap, helping organizations develop a program better suited to their diverse digital workforce.
Implications for the Future
The widening AI governance gap presents pressing challenges for enterprises as they adapt to an increasingly automated operational environment. The rapid pace of AI agent proliferation means businesses must act quickly to implement comprehensive oversight strategies. Organizations that do not address these challenges risk operational inefficiencies and security vulnerabilities that could lead to significant data breaches or losses.
As AI continues to evolve, the conversation around governance will need to shift accordingly. Enterprises must prepare to manage not just human employees but also an expanding array of autonomous agents. The lessons learned from the shadow AI phenomenon may offer valuable insights as organizations seek to establish effective governance frameworks that encompass both human and non-human digital workers.
As AI agents become integral to enterprise workflows, the need for stable governance measures has never been more critical. Companies like KnowBe4 are at the forefront of this effort, providing tools and strategies aimed at bridging the AI governance gap and enhancing overall security.
The stories that move AI & crypto markets — before the market reacts.
Free. 7am ET. Five stories. 62,400 readers.
