An application appears. The security team blocks it. Employees find a workaround within days. The cycle repeats. Every round, the security team believes it is reducing risk and every round, the AI usage continues, just somewhere it can no longer see. The uncomfortable truth about banning shadow AI is that a ban does not reduce usage. It reduces visibility. And you cannot govern what you cannot see.
The Block-and-Workaround Death Loop
McKinsey’s State of AI report found that 76% of employees now use AI in some capacity at work, up from 55% the year before. Writing assistants, coding copilots, meeting summarizers, research tools, they are woven into daily work, and most were never reviewed by security. The conventional response is restriction: an application appears, the security team blocks it, and employees route around the block.
The reason restriction fails is not that employees are reckless. It is arithmetic. When the official approval path takes six weeks and a workaround takes six minutes, most people choose six minutes. Technology gets adopted because it is useful, and governance that ignores that behavior gets routed around every time. The block-and-workaround loop isn’t a discipline problem, it is a design problem.
A ban without an approved alternative does not reduce AI usage. It reduces visibility into it. The usage moves to personal accounts and personal devices, where the enterprise has no controls at all.
Propelex Security Intelligence
The data bears this out plainly. Somewhere between 40% and 65% of employees report using AI tools their IT department never approved, and 47% of all generative-AI users access those tools through personal, unmanaged accounts that bypass enterprise controls entirely. Blocking the sanctioned tool does not touch that traffic. It simply guarantees you cannot measure it.
Governance Is an Enablement Function
The security teams that have broken the loop did one thing differently: they stopped treating governance as a control function and started treating it as an enablement function. The goal is not to control the AI tools employees are already using. It is to make the secure path the one employees actually want to use.
That reframe changes the whole equation. Every piece of Propelex guidance is built to keep risk, value, and cost in balance at once, mitigate the risk, increase the value, reduce the cost and AI governance is where those three pull hardest against each other. A blanket ban optimizes for one variable, perceived risk reduction, while quietly making the other two worse: it kills the productivity value employees are chasing, and it raises cost by pushing data into ungoverned tools where a breach is more likely and more expensive. A fast approved path is the rare move that improves all three at once.
A fast, governed AI path lowers risk (sensitive data flows through sanctioned, opted-out tools instead of personal accounts), raises value (employees get the productivity they were already reaching for), and reduces cost (fewer breaches, less wasted spend on licenses nobody adopts because the approved tool is slower than the free one). Restriction improves none of these, it just hides the problem.
When security builds from that understanding, something rules alone cannot produce starts to happen: employees use the sanctioned system willingly, and the organization begins to see security as the team that understands both people and risk. That reputation compounds. The CISO who is known for a fast, sensible path gets pulled into strategy conversations at the planning stage before decisions are locked where their input actually shapes the outcome.
You Can’t Govern What You Can’t See
Enablement starts with visibility, and most organizations are starting from close to zero. Only about 37% have any AI governance policy at all, which means roughly two-thirds are operating with no guardrails while three-quarters of their workforce uses AI daily.
The foundation of any real program is a current inventory: which AI tools are running, who relies on them, and what data each one can access. OAuth audits of connected applications and browser-native monitoring build that picture quickly and they surface the risk that matters most, like a productivity tool connected to a shared drive that can hand an entire repository of documents to a third-party vendor. Without that inventory, governance is guesswork. With it, every subsequent decision has a factual basis.
The Policy That Actually Works
An AI acceptable-use policy that employees follow does four concrete things and one that most organizations skip.
- Lists approved tools with a clear path to access them. The employee should be able to see, in one place, what is sanctioned and how to start using it today.
- Defines which data categories stay out of AI tools entirely. Source code, regulated records, and customer PII need explicit, unambiguous boundaries, not left to individual judgment.
- Confirms training opt-out status for every approved tool. Employees should know that a sanctioned tool will not train on their inputs, because that assurance is often the whole reason they were nervous about the tool in the first place.
- Gives a process to request new tools, with a turnaround time. A published SLA is what makes the official path competitive with the workaround. Six days beats six weeks; six weeks loses to six minutes.
The element that gets skipped most often is the reasoning. An employee who understands why connecting a productivity tool to a shared drive can expose the whole drive carries that judgment into every future decision. Reasoning is what converts a rule read once into a habit applied for years.
Propelex Security Intelligence
The reasoning is the multiplier. A policy that only lists rules governs the decisions it anticipated. A policy that explains its logic governs the decisions it never imagined because employees who understand the “why” make sound calls about tools that did not exist when the policy was written. In a field where a new AI capability appears weekly, that is the difference between a document and a culture.
What to Build This Quarter
- Inventory first. Run OAuth audits on connected apps and add browser-native visibility. You cannot govern, approve, or measure what you cannot see and most organizations underestimate their AI footprint by an order of magnitude.
- Publish the approved list. Make the sanctioned tools and the path to access them visible to every employee. An approved tool nobody knows about is functionally not approved.
- Set a request SLA and keep it. Commit to a turnaround time for new-tool requests and hit it consistently. The credibility of the whole program rests on the official path being genuinely fast.
- Explain the reasoning, not just the rule. For every boundary, publish the why. It is the single cheapest control that scales to decisions you never anticipated.
- Provide sanctioned alternatives before restricting. Unauthorized use drops roughly 89% when a good approved option exists. Restriction without an alternative just relocates the risk to where you can’t see it.
- Measure shadow-AI decline as your success metric. Track unsanctioned usage before and after. A program that is working shows falling shadow AI and rising sanctioned adoption, that is the number to report to the board.
The Bigger Picture
AI adoption is accelerating regardless of what any governance effort does. The only variable a security team controls is whether that adoption happens where they can see it or where they cannot. Restriction feels like control, but it chooses invisibility. Enablement feels like a loss of control, but it is the only path that actually produces it.
The clock is also running. A projected one in four compliance audits in 2026 will include specific inquiries into how AI tools and data are governed, and Gartner expects AI governance spending to pass a billion dollars by 2030. The organizations that build the fast, visible path now are the ones that will have an answer when the auditor, the regulator, or the board asks what your employees are doing with AI and where the data goes.
Security’s instinct is to say no. But the teams earning a seat at the strategy table are the ones who learned to make the secure path the fast path. Do that, and you don’t just govern AI you become the reason the organization can adopt it at all.
Propelex Security Intelligence
Your employees have already chosen AI. The only open question is whether your security program is the reason they use it safely, or the reason you can no longer see how they use it at all. The fastest path to AI adoption really does run through security but only when security decides to build the road instead of the roadblock.
Propelex’s AI Security & Privacy practice helps organizations turn AI governance into an enablement function, inventorying every AI tool and shadow app in use, building acceptable-use policy that employees actually follow, and creating the fast, sanctioned paths that cut shadow AI while keeping risk, value, and cost in balance. Fortune 50-experienced consultants across regulated industries.
