GenAI omnipresent - governance lags behind
99% of European companies are already using generative AI, but control over sensitive data is not keeping pace with the rapid spread. The Netskope Threat Labs Report Europe 2026 shows where the greatest risks lurk - from data protection breaches to the misuse of trusted cloud platforms.
Almost all companies in Europe use generative AI - but governance is still lagging behind its use. This is shown by the latest Netskope Threat Labs Report Europe 2026, which analyzes adoption trends, data breaches and malware distribution via cloud applications over the past year.
Almost complete AI penetration
The figures are clear: 99% of European companies now use GenAI applications. Active use by employees has almost doubled from 35% to 65% within a year. At the same time, there has been a clear shift towards company-controlled solutions: the proportion of personal GenAI accounts has fallen from 79% to 43%, while managed company solutions have increased from 28% to 72%.
Nevertheless, Shadow AI remains a real problem: the proportion of users switching between private and corporate accounts rose from 7 to 15 percent - an indication that user-friendliness and accessibility are not yet sufficiently addressed in many environments. ChatGPT remains the most widely used GenAI application in Europe with a usage rate of 88 percent. Anthropic Claude has established itself in second place with 79% - well ahead of Google Gemini with 69% - and has seen a rapid increase in adoption of 29% as of September 2025. Mistral Le Chat is now used by 8 percent of companies.
Regulated data as the greatest risk
When analyzing data protection violations, a clear pattern emerges: regulated data is responsible for 59 percent of all policy violations in connection with GenAI. Source code follows with 15 percent, intellectual property with 13 percent and passwords and API keys with 12 percent.
A similar picture emerges for private cloud applications: Here, regulated data accounts for 63 percent of breaches, followed by intellectual property at 17 percent, passwords and API keys at 11 percent and source code at 9 percent. The personal apps for which most companies enforce real-time controls are Google Drive with 32 percent, ChatGPT with 27 percent and Google Gmail with 22 percent.
«Europe has moved beyond the initial enthusiasm for generative AI and is now moving towards a more hands-on reality where usage is widespread but control is still lagging behind,» explains Gianpietro Cutolo, Cloud Threat Researcher at Netskope Threat Labs. «Organizations are increasingly shifting their focus from personal AI tools to managed environments, but data breaches still mainly affect regulated data, which shows where the real risk still lies. As AI is increasingly embedded into everyday workflows rather than being used as a standalone tool, the challenge is no longer one of adoption, but of maintaining visibility and control over sensitive data as it flows through increasingly complex and interconnected systems.»
AI more deeply integrated than visible
Particularly relevant for security teams: 64% of users interact directly with GenAI applications. However, far more - 95 percent - use applications that embed AI functions indirectly. 89 percent use applications that draw on user data for their training. AI has therefore long been running in the background - even where employees are not consciously using it.
Attackers abuse trusted cloud services
In addition to the governance risks posed by AI adoption, the report shows a worrying shift in attack tactics: GitHub and Microsoft OneDrive are the most frequently abused platforms for malware distribution in Europe - 10 percent of companies are affected in each case. Attackers are specifically exploiting users' trust in known services to place malicious content and make detection by security systems more difficult.
Operational reality versus regulatory gap
The results highlight a structural tension that is putting IT security managers in Europe under increasing pressure: AI is deeply rooted operationally, but the control mechanisms are not yet. Regulated data flows into systems that are not fully monitored - and attacks disguise themselves as legitimate cloud traffic. For companies operating under GDPR, NIS2 or industry-specific compliance requirements, this significantly increases the urgency of robust AI governance.
Source: Netskope
