ProHance Built a Scorecard for AI ROI. The Numbers Behind It Need a Caveat.
The 43 per cent shadow-AI breach figure comes from IBM’s Cost of a Data Breach report, whose own authors describe a nonstatistical sample biased toward mature organisations.
ProHance launched an AI Adoption Index on 29 October, a scorecard that places teams on a maturity ladder, measures whether AI use reaches real work, and flags unapproved tools. The pitch for an AI ROI scorecard is sound and the problem is real: most enterprises can tell you how many licences they bought and roughly how many people logged in, and very few can tell you whether any of it changed how work gets done. The release supports that argument with two striking figures, and it does not say where they come from. They come from IBM’s 2026 Cost of a Data Breach report, and that report is more careful about its own limits than the release is.
Both things can be true at once: the statistics are real and properly sourced, and they are weaker evidence than they appear when quoted alone.
What the Index actually measures
The product has three functions. Map places each team on a maturity model. Measure identifies which teams lag and estimates capacity freed for higher-value work. Mitigate detects shadow AI, routes each unapproved tool through a review workflow and keeps an audit trail. Those sit inside four views: an adoption overview, a financial return view, a governance dashboard and a Team Compass that tracks an AI leverage ratio and the shift of human effort toward higher-value work.
The differentiating claim is that three existing categories of tool each see a third of the problem. Usage analytics stop at activity. Governance and security tools control approval and spend but cannot show whether AI changes the work. Output tools track what shipped. ProHance argues the Index joins all three. That is a coherent AI ROI product thesis, and it is why the company can charge for a measurement layer rather than another dashboard.
The company’s standing matters for judging the product. ProHance reports more than 450,000 users across 220 enterprises in 55 countries, with modules spanning work time, work output, workflow management, asset optimisation and a retention risk index, and it holds a Star Performer position in the Everest Group’s 2026 People Analytics Platforms assessment. That is a real installed base in workforce analytics, and it is why a measurement layer is plausible from this vendor rather than from a new entrant: the telemetry already exists, and the Index sits on top of it.
The statistics and where they come from
The release reports that incidents involving shadow AI accounted for 43 per cent of all breaches, up from 20 per cent in 2025, and that 92 per cent of organisations reporting an AI-related security incident lacked adequate AI access controls. Both figures are accurate, and both belong to IBM’s 2026 Cost of a Data Breach Report, produced by the Ponemon Institute and published on 29 July. The study covered 602 organisations breached between March 2025 and February 2026, across 16 countries and 17 industries, drawing on 3,558 interviews.
The same report supplies context the release leaves out. Shadow AI breaches averaged 5.39 million dollars, against 4.63 million a year earlier. The global average breach cost reached 4.99 million, up 12 per cent to a record. Sixty-eight per cent of breached organisations had no AI governance policy in place. Only 40 per cent applied access controls to AI models and data at all, and only 29 per cent ran regular audits for unsanctioned AI. Those numbers describe the same problem ProHance sells against, and several of them are more damning than the two in the release.
The caveat the release omits
Here is the part that matters for anyone quoting those figures in a board deck. The report’s own methodology section is unusually candid, and it states that the sample is nonstatistical, so margins of error and confidence intervals do not apply. The sampling frame was judgmental and, by the researchers’ own assessment, biased toward organisations with more mature privacy and information security programmes. Costs are extrapolated rather than drawn from financial records. Nonresponse bias was not tested. Every governance figure is self-reported by people describing their own organisation’s failures.
There is also a commercial alignment worth naming: IBM sponsored, analysed and published the study, and sells the identity, encryption and security automation products its findings favour. That does not make the data wrong. It does mean the 43 per cent and the 92 per cent are directional indicators from a self-selected sample rather than measurements of a population, and a vendor quoting them to justify a purchase should say so.
None of this is unique to ProHance. The IBM report has become the default citation for shadow-AI risk across the security industry, and the same two figures appear in dozens of vendor decks with the same missing caveat. That makes the quoting practice a sector-wide problem rather than a company-specific one, and it is worth stating plainly: an industry that has learned to source its statistics but not to describe their limits is only halfway to being evidence-led.
The evidence ProHance did not use
More interesting is what the release omits from its own portfolio. In August, ProHance published a joint study with Zinnov, titled Navigating AI ROI, based on more than 160 survey responses and over 50 hours of interviews with global capability centre leaders. It found that 92 per cent of those centres are piloting or scaling AI while 72 per cent of leaders lack a structured framework to measure the return. Fifty-five per cent cited absent AI governance, 63 per cent cited visibility and measurement depth, and 66 per cent cited data readiness and infrastructure.
Buried in that study is the strongest evidence ProHance has: a controlled comparison at a professional services capability centre, run over eight weeks. One team performed 12 software development activities without AI, the other with AI, on a shared backlog and sprint cadence with a common definition of completion. The AI team finished in 309 hours against 391, an 80-hour saving and roughly 21 per cent less effort. Application switching fell by about 1,100 instances, or 13 per cent. Eight of the 12 activities showed reduced effort. That is a matched-cohort design with a baseline, which is precisely what the AI ROI debate lacks, and the launch release does not mention it once.
Note also what the Zinnov framework asks for: a baseline established before the pilot, adoption measured at the workflow level rather than the licence level, and value connected to operational outcomes. Those three requirements are unglamorous and they constitute the whole method. An organisation that sets a baseline before deploying AI can measure its AI ROI with a spreadsheet. One that does not will buy a dashboard and still not know.
Breadth versus depth
The sharpest formulation of the problem comes from ProHance’s own marketing rather than the release. The company describes a team where 78 per cent of employees used an AI tool in a week for an average of 21 minutes a day. On most adoption reports that reads as healthy. But AI accounts for 5.35 per cent of their productive time. Breadth tells you how many people touched AI; depth tells you how much of the work it carries. Almost every enterprise measures the first, and the distance between those two numbers is the entire commercial case for a product of this kind.
The naming problem
One detail needs fixing before the Index travels further. The maturity model has three different sets of stage names in circulation. The release describes a ladder from AI-Aware to AI-First. ProHance’s own social posts describe AI Aware, AI Enabled, AI Engaged and AI Native. The product page describes Access, Integration, Co-Execution and Orchestration. These may map onto one another cleanly, but a measurement framework whose stages carry different names in each place is hard to adopt as a standard, and standards are what this category sells.
What to watch
Three markers. The first is whether the Index publishes its own methodology, because a scorecard nobody can audit is only a dashboard. The second is whether customers report the capacity-freed figure externally, since that is the number a chief financial officer will test first. The third is consolidation: Microsoft, Google and every AI vendor already ship usage analytics, and the open question is whether buyers will pay separately for an independent measurement layer or accept each vendor’s own view of its own product.
The consolidation question deserves more than a passing mention. Microsoft and Google ship adoption dashboards inside platforms most enterprises already license, and every AI vendor reports its own usage. An independent measurement layer therefore competes against something free, inside the existing bill. The counter-argument is that no vendor can credibly audit its own product, which is true and is the argument auditors have made for a century. Whether buyers pay for independence in a category this young is the commercial question the Index will answer, and it will answer it faster than any feature comparison.
What it signals
The launch marks a stage in enterprise AI where the argument has moved from capability to evidence. ProHance is not selling AI; it is selling the proof that AI paid. That is a reasonable business in a year when boards have started asking for the return on a line item that has grown faster than any other in the technology budget, and the companies that answer the question well will win the next round of funding.