AI Tool Sprawl Risks in Finance Departments

⟦H1⟧

AI Tool Sprawl Risks in Finance Departments.

AI agent sprawl in finance departments compared with other functions

Finance departments are running an experiment nobody signed off on: hand five to ten AI agents access across areas like AP, AR, reconciliation, close, and analytics, deployed by different teams from different vendors with varying access levels and monitoring, and see what breaks first. The early returns show the audit trail fraying, the credential perimeter thinning, and eventually somebody's afternoon spent explaining to an examiner why nobody can say which agent touched which account. Gartner expects the average Fortune 500 company to run more than 150,000 agents by 2028, up from fewer than 15 in 2025 https://www.gartner.com/en/newsroom/press-releases/2026-04-28-gartner-identifies-six-steps-to-manage-artificial-intelligence-agent-sprawl. Finance will not be the department that sits that one out, and the way this sprawl compounds is specific enough to trace step by step.

Start with the definition, because the two terms get used interchangeably and shouldn't be. AI tool sprawl is the unchecked spread of AI frameworks, models, agents, and SaaS integrations across an organization, each one keeping its own credentials, its own login pattern, its own quiet corner of the network nobody has mapped. Agentic sprawl is the sharper version: multiple uncoordinated agents operating without central oversight. The distinction that actually matters is that agents do not just read data the way a dashboard does. They act on it. A stale report is an inconvenience.

The arc is predictable, and predictability here is the worrying part, not the reassuring one. The first wave looks disciplined: one or two agents, IT in the room, permissions scoped and reviewed. Then success becomes the accelerant. The first agent works, closes books a day faster, earns trust, and that trust gets extended to the second agent without the same scrutiny. By the fifth or sixth agent, approval has become a formality riding on the reputation of the ones that came before it. Research points to a specific window where this breaks down: the governance gap tends to open between the third and eighth agent deployment, exactly where most finance teams stop treating each new agent as a discrete decision and start treating it as more of the same. Every agent is a new identity with a new set of permissions, and past deployment three, nobody is counting anymore.

Finance's existing access and control infrastructure, not built for agents

Access control in most finance shops rests on a flawed assumption: humans hold permissions but do not fully use them. Role-based access, periodic reviews, individual scoping, the whole apparatus, assumes a person who forgets to check a report, gets distracted, or simply does not exercise every privilege handed to them. That informal restraint has been doing more governance work than anyone gave it credit for, mostly because nobody noticed it was load-bearing until it was gone.

Agents do not forget and they do not get distracted. An agent granted a permission uses it, every time, at machine speed, with no hesitation and no judgment call about whether it should. Humans routinely ignore the access they have been handed. Agents exploit all of it, all the time. The informal safety buffer that made human-scale permissioning workable simply is not there anymore, and nothing has replaced it.

There is a vector almost nobody watches for. SaaS vendors keep bolting AI features onto products that were approved years ago, and because the product itself already cleared procurement, the new AI capability rides in without triggering a fresh review. The capability just appears in the interface one morning. IT gets no alert, security gets no flag, compliance gets no record, and this applies to tools already sitting inside the finance stack, not some exotic new purchase.

The policy numbers underline how wide this gap runs. Only 8% of organizations using AI maintain a governance framework that qualifies as comprehensive, and only 37% have any AI governance policy at all https://evolvancemarketresearch.com/statistics/ai-governance-statistics/ https://www.vectra.ai/topics/shadow-ai. Meanwhile 98% of organizations run at least one SaaS application with AI built in, and fewer than 30% have built a formal vendor risk assessment process for it https://www.practical-devsecops.com/ai-security-statistics-2026-research-report/. That gap between exposure and oversight describes most of the industry, not an unlucky minority, and treating it as an edge case is the first mistake most finance leaders make.

Credential exposure and access sprawl when multiple agents share ERP write access

Every agent connection is a new identity. Each one carries its own permission set and its own accountability blind spot, and the credential surface multiplies with every tool added to the stack, not additively but compounding. Nobody drew a map of the resulting lattice of overlapping write privileges, and mapping it after the fact is a lot harder than building it correctly the first time.

The finance-specific danger is concentration. Multiple agents holding ERP write credentials create a wide, distributed attack surface, and because those agents often share infrastructure or vendor tooling, a single supply chain compromise on one component can take down credentials across the whole fleet at once. No verified public case yet matches that exact shape, so call it a demonstrated structural risk rather than a confirmed breach with a name attached. The mechanism is real even where the headline case is not.

OAuth makes the problem worse in a way that is almost architectural. Tokens granted to AI extensions persist indefinitely unless someone manually revokes them, and they survive password resets and even device changes. Standard offboarding, built around rotating a departing employee's credentials, never touches this layer. The token sits there: a permanent side door nobody remembered to lock because nobody knew it existed. Roughly two-thirds of organizations already carry risky OAuth scopes somewhere in their environment, and the average enterprise runs more than 23,000 SaaS applications entirely outside centralized IT visibility. More than 23,000 SaaS applications operate outside centralized IT visibility in the average enterprise.

Conflicting ERP writes, fragmented audit trails, and financial reporting integrity

Neither agent is malfunctioning, and neither is wrong in isolation. That is what makes this failure mode hard to catch before it costs something. The result still shows up as a GL posting error, a reconciliation break, or a straight data consistency failure, and explaining to an auditor that the system worked exactly as designed does not go over well.

An agent is only as reliable as the data it is fed. If the chart of accounts has drifted out of consistency, if vendor records got duplicated somewhere along the way, if a chunk of transaction data still lives in a spreadsheet that never made it into the ERP, the agent does not know to question any of it. It learns from what is there and acts on it. Duplicate records, incomplete master data, failed system interfaces, botched data transformations: these are old finance problems, but multiple agents writing simultaneously against the same objects turns each one from an annoyance into a multiplier, and multipliers are hard to trace back to a source.

Then there is the audit trail, or rather, the absence of one. Every agent tends to log its own actions in its own format, on its own schedule, in its own system. There is no unified record. When the books do not close cleanly and someone needs to reconstruct which agent wrote what, in what order, and why a reconciliation broke, that reconstruction is not possible because each agent produces its own log in a different format, with no unified record of finance AI actions. The close process used to leave a paper trail, even a bad one. Now it leaves five paper trails written in five different formats, and none of them talk to each other.

The regulatory exposure finance AI sprawl creates, and the frameworks now demanding specific controls

Uncoordinated AI deployment in financial services spreads regulatory exposure across SEC, FINRA, MiFID II, and Basel III requirements without any single actor realizing it. Nobody owns the exposure because nobody was assigned to own it.

The U.S. Treasury's FS AI RMF was built specifically to close that gap, developed alongside more than 100 financial institutions, the Financial Services Sector Coordinating Council, and the Cyber Risk Institute. It lays out 230 control objectives spanning governance, data integrity, model development, explainability, monitoring, third-party risk, and fairness and consumer protection. It is heavy by design, not an oversight checklist someone trims down later.

Lowenstein Sandler does not describe it as a checklist at all. The firm calls it an "operational architecture standard" and a "remediation blueprint," language chosen because the framework is meant to hold up under a supervisory exam, not survive an internal audit where the reviewer already works for the company. The identity and access layer is where the framework gets most specific to the exact problem this piece has been building toward: it addresses human and nonhuman identity management, role-based access controls, and decision-path auditability directly, which in plain terms means knowing which of your agents can write to what, and being able to prove it later.

A real incident: the CB Financial Services case of May 2026

On May 5, 2026, Community Bank, the wholly-owned subsidiary of CB Financial Services, Inc., became aware of an internal incident involving the handling of certain non-public customer information through an unauthorized artificial intelligence-based software application. That is the extent of what is confirmed, and the rest should not be filled in.

The shape of the case matters more than an outcome that has not been established yet. An unauthorized tool, non-public customer data, an internal discovery process rather than an external one: those are precisely the three elements the FS AI RMF was built to prevent, laid out in a single real institution rather than a hypothetical. What happens next in terms of remediation or regulatory response is not public, and speculating on it would add nothing. What is already public makes the point on its own: the incident pattern matches the research profile exactly, a tool deployed without IT review or procurement approval, sensitive financial data entered into it, and the whole thing discovered internally rather than prevented at the gate.

A workable governance framework for finance AI agents

Deloitte's 2026 guidance, "Managing the New Wave of Risks from AI Agents in Banking," lands on a model it calls the agent control room, built around four core pieces.

The first is a centralized agent registry. Every deployed agent gets logged with its name, vendor, function, exact ERP permissions down to read/write scope, an assigned owner, a deployment date, performance thresholds, and an escalation path. Most finance departments have no such single source of truth. Most of them cannot answer "how many agents have write access to our ERP" without a multi-week fire drill.

The second is a kill switch. Every agent has to be stoppable on its own, independent of the rest of the finance stack, without a shutdown cascading into systems that had nothing to do with the problem. Most current deployments fail this test because nobody designed for it from the start.

The third is named ownership: a single accountable governance owner spanning all agents, rather than oversight scattered across functional teams who each manage their own corner and never compare notes. This is not a compliance nicety, and treating it as one misses the substance of what it demands. It is a performance variable with a number attached: teams with no clear AI ownership reported positive ROI only 9% of the time, compared to 46% when a CFO or finance leader owned the initiative directly. Anyone arguing that ownership can stay distributed across three departments is arguing against a five-fold difference in outcome, and the argument does not hold.

The FS AI RMF backs the same instinct from the regulatory side: controls need to be built into CI/CD and MLOps pipelines upstream, not bolted on after deployment, and the same logic applies to agents. Governance goes in at launch. Retrofitting it after an incident is not governance, it is damage control wearing a governance costume. ABA Banking Journal's piece asking "Are We Sleepwalking Into an Agentic AI Crisis?" named this exact gap as a systemic risk to financial services, which gives any CFO trying to justify a control room investment a credible, named external voice to point to. A Deloitte CFO Signals survey found 41% of organizations discovered AI-related spending running 30 to 60 percent above what central finance had tracked https://thinking.inc/en/role-guides/cfo-ai-governance/. A control room with spend visibility built in solves a budget problem and a security problem with the same fix.

Detecting sprawl already in motion: the discovery problem before the governance problem

Before any framework gets built, a more basic question needs an answer: does anyone actually know what is running right now? Only 14.4% of organizations have full security approval covering their entire agent fleet, and mean monitoring coverage is around 52% https://www.lyzr.ai/blog/tool-sprawl-agentic-ai. Roughly half of all agents in production, across every function, operate with no active oversight whatsoever. Discovery has to come before governance, because nobody governs what they have not found yet.

For finance specifically, the practical starting point is mapping every known agent against ERP write permissions. Agents holding write access that do not appear anywhere in a registry are the highest-priority risk. Read-only agents with no logging trail come second.

Shadow AI risk in finance includes SaaS-based AI integrations that expand unchecked, each maintaining its own credential stores, usage patterns, and access methods, creating an environment that is increasingly difficult to audit or govern. The second is personal account usage, and the number here is not small: nearly 47% of generative AI users access tools through personal, unmanaged accounts, either exclusively or alongside whatever the company actually approved https://www.vectra.ai/topics/shadow-ai. In financial services specifically, 72% of employees admit to using at least one unsanctioned AI tool, and 23% have gone as far as sharing financial statements or sales data with a tool nobody vetted https://airia.com/blog/shadow-ai-statistics-key-data-points-every-ciso-needs-in-2026/ https://www.cloudeagle.ai/blogs/shadow-ai-financial-services.

The exposure is not theoretical or future-tense. Harmonic Security's analysis of more than 22 million enterprise AI prompts found upwards of 579,000 sensitive data exposures, and 16.9% of those happened on personal free-tier accounts, sitting entirely outside whatever perimeter the enterprise thought it had built https://www.adaptivesecurity.com/blog/shadow-ai-risks-2026. IBM's Cost of a Data Breach Report puts a number on what happens when that exposure turns into an actual breach: shadow AI incidents cost an average of $670,000 more than standard breaches, and take an average of 247 days to detect https://www.dsalta.com/resources/ai-compliance/shadow-ai-compliance-risks-governance-guide. Eight months is roughly the shelf life of an entire fiscal quarter's worth of bad data compounding undetected before anyone notices. The fix is knowing, on any given morning, exactly which agents are writing to the ledger and who is accountable for each one, not another dashboard. It is knowing, on any given morning, exactly which agents are writing to the ledger and who is accountable for each one, and right now almost nobody can answer that question with a straight face. By the end of 2026, 40% of enterprise applications are expected to ship with task-specific AI agents https://gogloby.com/insights/what-is-ai-sprawl/. Netskope's Cloud and Threat Report found that enterprises averaged 223 AI-related data policy violations per month https://gogloby.com/insights/what-is-ai-sprawl/. By 2027, shadow AI is projected to cost enterprises more than $40 billion in unplanned remediation, compliance penalties, and productivity losses https://airia.com/blog/shadow-ai-statistics-key-data-points-every-ciso-needs-in-2026/. In Zone & Co's 2026 AI Impact vs. Hype survey of 565 finance professionals, 43% said that when AI fell short, the primary consequence was increased workload to correct or reconcile data https://www.zoneandco.com/articles/the-cfos-guide-to-ai-tool-evaluation-glenn-hoppers-proven-framework. AI-related SaaS attacks increased approximately 490% year over year https://securityboulevard.com/2026/05/ai-governance-statistics-for-2026-trends-risks-enterpris/. More than 80% of SaaS and AI incidents involved sensitive or regulated data https://securityboulevard.com/2026/05/ai-governance-statistics-for-2026-trends-risks-enterpris/. Gartner predicts that by 2030, more than 40% of enterprises will experience security or compliance incidents linked to unauthorized shadow AI https://www.vectra.ai/topics/shadow-ai. Only 13% of organizations believe they have the right governance in place for managing AI agents https://www.kore.ai/blog/what-is-ai-agent-sprawl.