Cloud and Threat Report:
2026

The previous section focused on how content-aware data protection policies can control the flow of sensitive data in genAI apps. The underlying assumption was that those apps must be safe to use in specific contexts and serve some legitimate business purpose. When an app is not safe to use in any context or doesn’t serve any legitimate business purpose, risk reduction becomes much easier: just block the app completely. 90% of organizations use this basic but effective strategy, with the average organization actively blocking 10 apps. Here, an “active block” means not only that an organization has a policy to block the app for all of its users, but that the policy is actively preventing users from attempting to use the app (as opposed to a policy that blocks something that nobody is trying to use anyway). Although each organization’s policies differ, some tools are restricted far more often than others, revealing where security teams see the most significant potential for harm. For many environments, blocking entire categories of high-risk genAI services may offer more manageable protection than evaluating tools one by one.

ZeroGPT is currently the most frequently blocked genAI-related application, with 45% of organizations restricting access. Many security teams view the service as high risk because AI-detection tools often require users to submit full text, source code, or other sensitive material for analysis.

DeepSeek follows with 43% of organizations blocking it, driven by worries about limited transparency, rapidly evolving platform behavior, data sovereignty, and uncertainties associated with emerging AI ecosystems.

These blocking trends suggest that organizations are not only reacting to the risks posed by individual tools but also maturing their governance strategies. The emphasis is shifting toward preventing sensitive data from leaving the organization in the first place, particularly to services with unclear security guarantees or insufficient disclosure about how user content is processed and stored.

Block policies for unwanted AI apps have generally been very effective. Although the number of genAI apps Netskope Threat Labs is tracking has increased fivefold, from 317 to more than 1,600 over the past year, the average number of AI apps used in an organization rose just 33% from 6 to 8. Only in the top 1% of organizations (not pictured), where controls are more lax, did we see significant increases, from 47 to 89 apps. These outlier organizations should serve as a reminder for all organizations to take inventory of how many genAI apps they are using and whether they all serve a legitimate business purpose. Outlier organizations can significantly reduce their risks by simply restricting access to apps that are not business-critical and applying data protection and coaching policies to apps that are.

In 2026, we expect that the number of outlier organizations allowing the use of tens of genAI applications will fall as more organizations begin to exert control over their genAI ecosystems, driven by the continuing introduction of new genAI apps and new ways of interacting with genAI apps, like AI browsers. After gaining improved visibility into their genAI use, more organizations will take a more proactive approach of blocking all AI applications except for those on an approved list.

Along with AI browsers and MCP servers, another emerging trend in the genAI space that is compelling organizations to evolve their security posture is agentic AI. Agentic AI systems are those that execute complex, autonomous actions across internal and external resources. Already, organizations are seeing rapid adoption of agentic AI, both using SaaS services and AI platforms like Azure OpenAI. While early adoption favored SaaS applications for their convenience, platform-based solutions now allow companies to host models internally, integrate them with existing infrastructure, and build custom applications or autonomous agents tailored to specific workflows.

Currently, 33% of organizations use OpenAI services via Azure, 27% use Amazon Bedrock, and 10% leverage Google Vertex AI. The shift toward these enterprise-grade platforms is driven by the expanding availability of secure, cloud-based genAI services that offer stronger privacy controls and deeper integration options. Year-over-year growth further underscores this momentum: the number of Bedrock users and the amount of Bedrock traffic have both increased threefold, while the number of Vertex AI users has increased sixfold with a tenfold increase in traffic. These trends highlight how rapidly organizations are scaling their genAI infrastructure as they explore more private, flexible, and compliant deployment frameworks.

Even as data increasingly flows through managed frameworks, whether via hosted models or autonomous AI agents, security risks remain high. The rapid rise of agentic systems introduces new attack vectors, including tool misuse, unsafe autonomous actions, and expanded pathways for data exfiltration. Managed models reduce some risks but cannot eliminate exposure from prompt injection, over-permissioned tool access, insecure API integrations, or unintended cross-context data leakage. As AI agents gain the ability to execute tasks and interact with internal and external services, the potential impact of misconfigurations or compromised workflows grows significantly. Organizations adopting these platforms must pair modernization with rigorous security controls, continuous monitoring, and least-privilege design to ensure that scalability does not come at the cost of safety.

Even when AI agents and applications run on-premises or within managed enterprise environments, the underlying models are still frequently accessed through cloud-hosted APIs rather than through traditional browser interfaces. While browser-based interactions route through domains like chatgpt.com, automated workflows, internal tools, and AI agents rely instead on endpoints such as api.openai.com for programmatic access.

This shift is accelerating quickly. Today, 70% of organizations connect to api.openai.com, reflecting OpenAI’s dominant role in non-browser genAI usage across internal tools and agentic systems. AssemblyAI follows at 54%, driven by its strong speech-to-text and audio intelligence capabilities. Anthropic’s APIs are used by 30% of organizations, a trend fueled by growing developer adoption of Claude models for reasoning-heavy tasks, structured analysis, and application development.

As AI continues to move deeper into operational infrastructure, API-based genAI usage will likely accelerate, becoming one of the primary channels through which enterprise automation and AI agents interact with large language models.

The increasing adoption of agentic AI is amplifying not only the data exposure risks highlighted earlier in this report (because agents can send data to genAI apps at a much faster rate), but also amplifying insider risks, since an agent given access to sensitive data or systems can do damage at a much higher rate. Not only might a malicious insider leverage an agent to inflict harm on their organization, but a negligent insider might misconfigure or imprecisely prompt an agent. The non-determinism of agentic systems based on LLMs amplified these risks even further–hallucinations along the way might compound to cause data exposures or other organizational damage.

The rapid proliferation of agentic AI, alongside its shift toward platform-based, API-driven workflows, sets a challenging security mandate for 2026. Organizations must recognize that while these autonomous systems enable new levels of efficiency, they also dramatically expand the attack surface and accelerate the potential for insider-driven data exposure. As agents gain greater access and autonomy, success in 2026 will hinge on pairing this innovation with rigorous security modernization—specifically, implementing continuous monitoring, least-privilege principles, and robust, agent-aware controls to contain the amplified risks of tool misuse and unintended data exfiltration.