Employees turn to shadow AI when workplace tools fail them

Full text

Shadow AI is a security issue. When employees use unsanctioned AI tools without formal oversight, sensitive information can end up in platforms the business has not approved, monitored or secured.

The risks around data protection, compliance and governance are real, and organizations are right to take them seriously.

But if we view shadow AI only through a security lens, we risk treating the symptom rather than the cause.

Most employees are not deliberately trying to bypass policies or create risk.

In most cases, they are trying to solve a problem quickly and move their work forward. When approved tools are slow, difficult to access, limited in functionality or unclear to use, people naturally look for alternatives that help them get the job done.

That means shadow AI is not just a security challenge. It is also a signal that workplace technology is failing to meet employee needs.

For organizations, the lesson is clear: reducing shadow AI requires more than stronger controls. It requires providing employees with secure, accessible tools that are capable of supporting the way work actually happens.

When approved tools are not enough

Many organizations still frame unsanctioned AI use as a failure of employee behavior. From that perspective, the answer seems simple: issue stricter policies, block more tools and remind people of the risks.

This may reduce some exposure in the short term, but it rarely solves the underlying problem. Employees turn to AI tools because they offer speed, convenience and support with tasks that official systems may not handle well.

The challenge is not only that employees are using the wrong tools. It is that the approved route may not feel practical enough to use.

That distinction matters. If the official process is too slow, people may bypass it. If the guidance is too vague, teams may make their own decisions. If approved tools do not meet real business needs, unofficial ones will fill the gap.

Shadow AI is therefore not just a sign of poor compliance, but can also be a signal of underlying friction.

Digital friction creates hidden risk

Digital friction refers to the everyday technology barriers that make it harder for employees to do their jobs efficiently. It might be a login process that takes too long, a blocked platform that prevents a simple task, an approval workflow that slows a project or a sanctioned tool that lacks the functionality employees need.

Individually, these problems may seem minor. Together, they shape how employees behave.

When workplace technology makes work harder, employees become more likely to find their own solutions. Research has found that 80% of employees lose time to dysfunctional IT, costing them an average of 1.3 workdays per month. Almost half also say it has delayed critical operations or projects.

The risk is not only lost productivity . Digital friction can also weaken trust in approved systems, pushing work into less visible environments where security teams have less oversight.

This is why blocking tools without addressing employee needs can backfire. It may push behavior further out of sight rather than bringing it under control.

Security cannot succeed if it competes with productivity

For years, security has often been seen by employees as something that interrupts work.

Password resets, access requests, approval chains and tool restrictions all exist for valid reasons, but they can still feel like barriers when they are poorly designed.

The same is true for AI governance. A policy that simply says which tools cannot be used is unlikely to be enough. Employees need practical guidance on what they can use, what information can be entered and where to go when they are unsure.

The secure route has to be clear enough to follow and useful enough to choose.

This does not mean weakening security. It means designing security around how work actually happens. The strongest controls are often the ones that employees can follow without feeling they are being forced to choose between protection and productivity.

Authentication is a useful example. Passwords have long been a source of frustration for employees and a known weakness for organizations. Approaches such as zero trust and biometric authentication can strengthen protection while improving the user experience.

The principle is simple: good security should reduce risk without adding unnecessary friction.

AI governance needs an owner

One reason shadow AI can grow quickly is that responsibility is often unclear.

AI tools can enter an organisation through different teams for different reasons. A small experiment in one department can become part of a core workflow before anyone has assessed the risk, agreed ownership or defined the rules.

As adoption grows, that governance gap becomes harder to ignore. This is especially true when employees are already questioning whether official routes can keep pace. Research has found that 62% of employees lack confidence that their IT teams are providing the latest AI and digital tools, while 57% do not trust their IT team to resolve issues quickly or effectively and 47% fear their IT team will not adequately protect personal or work-related data.

Security teams have an important role to play, but they cannot solve this alone. AI governance needs input from IT, legal, compliance, HR and leaders across the whole organisation. It must become a core part of the organization's operating model rather than a standalone policy.

That means establishing clear ownership for how AI is introduced, used and governed across the organization. It also means recognizing that governance is not only about stopping unsafe behavior. It is about enabling safe behaviorat scale.

Human oversight remains essential. AI can process information quickly, but it does not understand every business context, regulatory requirement or reputational consequence. People still need to challenge outputs and take responsibility for decisions that carry real-world impact.

Employees need guidance they can actually use

AI policies often fail because they are too abstract. Employees may be told to avoid sharing sensitive data and use approved tools, but that doesn't always help in the moment.

A team under pressure needs practical answers. Can this document be uploaded? Can this customer query be summarized? Can this dataset be analyzed? Which tool is approved for this task? Who should be asked if the answer is unclear?

Guidance needs to be specific, accessible and easy to apply during the working day. If employees have to search through long policy documents or wait days for an answer, they may default to the fastest available option.

This is where trust becomes critical. Employees are more likely to follow security guidance when they believe approved systems will help them do their jobs effectively. If they see official processes as slow, restrictive or disconnected from reality, they are more likely to look elsewhere.

Trust also depends on transparency. People need to understand why certain tools are restricted, how data is protected and what the approved route is designed to achieve. A policy that simply says “do not use this tool” does not build confidence. It creates a rule. Rules matter, but they work best when employees understand the reason behind them.

Security-by-design must apply to the workplace

Security-by-design is often discussed in relation to products and software development, but the same principle should apply to the digital workplace.

Too often, security is bolted on after a tool or process has already been adopted. By that point, controls can feel like an extra layer rather than a natural part of the workflow. Bringing security into the conversation earlier helps organizations identify risk before behaviors become embedded.

For AI, this means involving security, IT and governance teams before tools are rolled out widely. It also means listening to employees about what they need from those tools.

If approved AI systems are too limited, employees will work around them. If the access process is too slow, adoption will fragment. If guidance is unclear, teams will interpret the rules differently.

Understanding those pressures is central to reducing risk.

The easiest path should be the secure one

Shadow AI shows that workplace systems are struggling to keep pace with how work is changing. When employees turn to unsanctioned tools, it often points to a gap between what people need to do their jobs and what approved systems allow them to do.

The organizations that respond well will not be those that only add stricter controls. They will be those that make secure behavior easier to adopt than unsafe workarounds.

That requires clear ownership, practical tools, accessible guidance and security processes designed around real workflows.

In the age of AI, reducing risk means giving employees secure routes that are practical enough to use. When the approved path is also the easiest path, businesses can protect data without slowing people down.

We've reviewed and ranked the best password managers .

This article was produced as part of TechRadar Pro Perspectives , our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit