A Conversation about Governing Shadow AI at Work

[00:00:00] Right now, the person sitting next to you at work is, well, they're probably keeping a pretty massive secret from your company's IT department. Yeah, and statistically speaking, so is your CEO. Right. Which is just, I mean, it's a fascinating paradox, you know, especially when you think about how modern corporate environments are usually structured. We're so used to this world of just absolute visibility. Totally. I mean, we're used to total transparency.

[00:00:27] Exactly. Like, let's think about how this used to work, right? For decades, corporate software was, you know, heavily monitored. A company bought a program, they installed it on your computer, and the IT department could see exactly what you were doing. Mm-hmm. They knew when you were doing it, what data you were moving, all of it. Right. Approved or not approved. On the network, off the network. I mean, if you try to download something you shouldn't,

[00:00:53] this, like, giant red warning box popped up on your screen. Yeah. The organization had this complete transparent view into its own anatomy, basically. But that transparency has just vanished. It really has. Today, there is this, like, invisible parallel nervous system operating right underneath the surface of, well, almost every major company. And the most startling part isn't even just that it exists.

[00:01:18] Right. It's that the leadership team, the people tasked with governing these organizations, they often have absolutely no idea it's happening right under their noses. Exactly. And that invisible nervous system, that's our focus today. We are taking a deep dive into, honestly, one of the most widespread, quietly revolutionary workplace phenomena of our generation. It really is a revolution.

[00:01:40] We're talking about the secret use of generative AI tools. I mean, employees everywhere are leveraging artificial intelligence to do their jobs, you know, faster, more creatively, more efficiently. All while keeping it an absolute secret from their bosses. Yeah, their bosses, their IT departments, their security teams. It's wild. We're looking at an environment where, frankly, the rules have completely failed to keep pace with human behavior. Totally. And to help us navigate this, we are relying on a single, just incredibly comprehensive source today.

[00:02:10] We're looking at a 2026 paper by Dr. Jonathan H. Westover. Yeah, published in the Human Capital Leadership Review. Right. Titled, Out of the Shadows. And the subtitle really gives us our, you know, a roadmap for this deep dive. It's called, Why Employees Are Using Unsanctioned AI at Work and How Leaders Can Turn Hidden Experimentation into Governed Capability. And Dr. Westover has really pulled together a brilliant piece of synthesis here.

[00:02:36] I mean, he takes this massive stack of survey data spanning from 2024 to 2026. It's a lot of data. It is. He analyzes the financial impacts of corporate data breaches. And he filters all of this hard data through, you know, established academic theories on human behavior. Right. Technology acceptance, workplace psychology, all of that. Okay. So let's unpack this. Our mission today is to really figure out the underlying why of this secret behavior.

[00:03:04] We need to understand what's driving it. Exactly. The big idea we want to explore is that this shadow AI, which is, you know, the secret use of underproved tools, it isn't some malicious underground rebellion. Right. It's not rogue employees trying to sabotage their employers. No, we're going to see that it is actually this desperate cry for better tools. We're going to explore why the instinct to just ban these tools is completely backfiring. Oh, totally backfiring.

[00:03:32] We'll look at the staggering financial costs of ignoring the problem and discuss how smart organizations are actually taking these secret workarounds and turning them into a massive governed superpower. Because the stakes here, I mean, they go far beyond simple rule breaking. We're transitioning from an era where an employee might, you know, quietly use an unapproved calculator app on their phone. Right. Which is pretty harmless.

[00:03:54] Yeah. But now we're in an era where they might be pasting a company's most sensitive, unreleased strategic documents into a public neural network. A network that literally uses that data to train future models. It's terrifying. It's terrifying. But, okay, before we can begin to fix the problem or even, you know, judge the people doing it, we need to map the territory. We need to define what we're actually talking about. Exactly. We need to understand the size, the shape, and the semantics of this hidden world.

[00:04:22] So what exactly falls under the umbrella of shadow AI? Well, to grasp shadow AI, it's actually really helpful to look backward at a concept that information technology researchers have been studying for years. It's called shadow IT. Shadow IT. Okay, right. Yeah. So if we look at the work of researchers like Haag and Eckhart back in 2017, they define shadow IT as employees using hardware or software without formal IT approval. Oh, okay.

[00:04:51] So the classic example being like someone in marketing setting up a rogue Dropbox account to share massive video files. Exactly. Because the official corporate email server only allowed tiny attachments, so they just found a workaround. That is a perfect illustration. And what researchers found back then is totally foundational to what we're seeing now. Shadow IT was almost always adopted with entirely good intentions. They weren't trying to be malicious. Right. People weren't trying to steal data.

[00:05:20] They were just trying to overcome friction. They wanted to do their jobs effectively, and the official tools were standing in their way. So shadow AI is just the direct descendant of that behavior? Exactly. But the potential scale and the impact are, I mean, they're infinitely larger. So we can define shadow AI as the use of artificial intelligence tools, models, or even embedded features for work purposes without the knowledge, approval, or oversight of the organization. Okay. Got it.

[00:05:48] Now, the source introduces another term that gets thrown around constantly in the business press. BYO AI or bring your own AI. Yeah, that's a big one. Right. This term popped up really heavily in a 2024 Microsoft and LinkedIn survey. So are we saying BYO AI and shadow AI are just two different names for the exact same thing? They overlap, definitely. But the distinction is actually crucial, especially for anyone listening right now who wants to understand their own level of professional risk.

[00:06:18] Okay. Lay it out for us. So BYO AI simply means you are utilizing an AI tool that your employer did not provide or pay for. Like using your own credit card to buy a subscription. Exactly. Let's imagine you purchase a personal subscription to a premium AI chatbot. If your company has a clear written policy that says employees are permitted to use personal AI subscriptions for drafting general correspondence provided no client data is inputted. Right. Then you're following the rules. Right. In that case, you are engaging in BYO AI.

[00:06:48] But it is not shadow AI because it's out in the open and permitted by governance. Okay. That makes sense. The shadows only exist when the lights are off, basically. If the company says it's fine, you aren't in the shadow. Exactly. But building on that, the reverse can also be true. And this is where, frankly, a lot of employees get caught completely off guard. Oh. Okay. Imagine you are using an approved company-issued software suite that you've used for like five years. Okay. Totally sanctioned. Right.

[00:07:16] But one morning, the software vendor pushes an automatic update that seamlessly embeds a new generative AI feature right into the interface. Oh, I see where this is going. Yeah. And you start using that new AI button to analyze your company's proprietary data. However, your IT department hasn't actually vetted, security tested, or approved that specific AI capability yet. Ah. So in this scenario, you haven't brought your own tool. So it's not B-Y-O-A-I. Nope.

[00:07:44] But you are absolutely engaging in shadow AI because you're using an ungoverned, unapproved feature. Precisely. Wow. That is a fascinating trap. I mean, you could be actively violating company policy without ever installing a new application or, you know, visiting a new website. The shadow just sort of crept into your existing workflow. It's insidious. It really is. But let's look at the sheer scale of this phenomenon because the statistics in Dr. Westover's paper, I mean, they paint a picture of an absolute epidemic of secret usage.

[00:08:14] The numbers are staggering. Let's dive into the PagerDuty study from June 2026. They surveyed 1,250 office professionals at large organizations across the U.S., the U.K., Australia, and Japan. What is the actual scope of the behavior here? The prevalence is almost hard to comprehend. And PagerDuty found that 66% of office professionals stated they had used AI tools at work while actively believing that their company's policy did not allow it. Wait, 66%. 66%.

[00:08:44] Let's just visualize that for a second. If you look around a standard corporate conference room with, say, 10 people sitting around the table. Right. Six or seven of them are secretly breaking the rules to do their work. That's wild. It is wild. But the data actually takes that a step further into the realm of data security. Okay. Brace me. Of those surveyed, 88% admitted they had shared work-related information with public AI tools. 88%. So they are not just using it to, like, write a polite email to a vendor.

[00:09:13] No, they are actively feeding corporate data into public models. Okay. I have to play devil's advocate here for a minute because when I hear these massive numbers, the immediate stereotype that jumps to my mind is that this is just the youngest generation of the workforce. Right. Right. The digital natives. Yeah. Like, isn't this just Gen Z interns, the people who grew up optimizing absolutely everything on their phones, trying to cheat on writing long memos? It is the most common assumption for sure. And the data proves it is completely unfounded. Really? Yeah.

[00:09:42] The 2024 Microsoft and LinkedIn study did show very high usage among Gen Z, sitting at around 85%. Okay. So they are doing it. They are. However, the exact same study found that 73% of the oldest demographic of workers, the boomers, were doing the exact same thing. 73% of boomers? Yeah. That's huge. We are looking at a deeply ingrained, multi-generational shift in how work gets done. So it is absolutely not just the new grads trying to cut corners. It's the veterans of the industry as well.

[00:10:11] Oh, and to add a layer of complexity there, the pager duty study uncovered a demographic inversion that should honestly give every board of directors serious pause. Uh-oh. What did they find? When we look at who is breaking the rules, senior leaders, the very executives who are responsible for setting the corporate policies, were actually more likely than mid-level managers to be using these tools in secret. The executives? Yeah. You're kidding. Not at all.

[00:10:35] Furthermore, 77% of senior leaders held the belief that they understand AI better than their own technical IT teams do. Wait, 77% think they know better than IT? Yeah. That is compared to 66% of mid-level managers who felt that way. That is incredible. Yeah. I mean, we can literally picture a chief operating officer quietly, like, hiding their chat GPT browser tab from the 22-year-old IT support tech who comes in to fix their printer. It's a very real scenario.

[00:11:04] The people who are either writing the restrictive policies or failing to write any policies at all are the ones leaning on the technology the most heavily. Do we see this reflected across other industries and other surveys, or is this like an isolated finding? No. It is universally consistent across the research. For example, a RICO study published in October 2026 found 45% of workers using unapproved tools on a monthly basis. Wow.

[00:11:29] Lenovo conducted a massive survey of 6,000 employees across 12 different countries, bridging late 2025 and early 2026, and found that up to a third of the global workforce was bypassing IT governance entirely. A third of the globe. It's massive. And Gallup has been tracking this longitudinal growth, which is really interesting. Back in May 2023, 21% of U.S. employees were using AI at work. Fast forward to May 2026, and that number jumped to 52%.

[00:11:59] More than doubled. Yep. And it is particularly heavily concentrated in fields that require intense cognitive processing. So 42% in the tech sector, 27% in finance, and 22% in professional services. It's just an unstoppable tide. But, you know, the source material brings up a really vital distinction about the nature of the rules that are allegedly being broken. Right. The semantics matter here. Yeah. Dr. Westover draws a hard line between the word unsanctioned and the word prohibited.

[00:12:29] Why does that sort of legalistic distinction matter to the average employee? Think of it as the difference between running a red light and driving through an intersection that simply has no traffic signals at all. Okay. I like that. Prohibited means the organization has issued a clear, explicit mandate. Do not use generative AI for company business. A red light. Exactly. Unsanctioned, on the other hand, often just represents pure corporate silence. The company hasn't banned it, but they haven't approved it either. They simply haven't issued a policy.

[00:12:59] So there's just no light. Right. And what this vast body of research demonstrates is that when leadership remains silent on a revolutionary technology, employees do not simply, you know, pause their careers and wait for instructions. They just go. They fill the governance vacuum with their own judgment. If the company won't give them a map, they just start bushwhacking their own trails. So what does this all mean? If 66% of people from the new hires all the way up to the C-suite are risking reprimands or even risking their jobs to use a chatbot in the dark, why?

[00:13:28] That's the million dollar question. Why would a rational professional risk their livelihood just to use a piece of software? Well, to understand the powerful psychological drivers behind this, Dr. Westover points us back to a framework developed in 2014 by a researcher named Stephen Alter. It's known as the theory of workarounds. Okay. Let's unpack this. The theory of workarounds. How does this reframe the way we look at employees breaking the rules?

[00:13:53] Alter proposed that a workaround is a purposeful change that people make to a work system in order to bypass obstacles, constraints, or, you know, systemic breakdowns. Okay. The most crucial paradigm shift in this theory is that workarounds are not inherently malicious acts of defiance. They aren't. No, they are diagnostic signals.

[00:14:13] A workaround shows leadership exactly where the formal approved corporate system is fundamentally broken, too slow, or just inadequate for achieving the results the company itself is demanding. Oh, wow. Okay. If we view it through that lens, an employee sneaking an unapproved AI into their daily routine isn't trying to sabotage the enterprise. Not at all. They are actually trying to survive the enterprise's broken processes so they can hit their targets. That is the exact core dynamic.

[00:14:42] And the paper categorizes the drivers of this behavior into four main pillars. Okay. Let's go through them. The first one is the most intuitive, yet the most powerful. Performance expectancy. Meaning they expect it to work. In plain terms, the tools simply work. People are flocking to them because they genuinely, measurably believe that artificial intelligence makes them vastly better at their jobs. And it does, right? It really does.

[00:15:07] The barrier to entry for generative AI is essentially zero, and the cognitive payoff is instantaneous. A 2025 survey by the security firm 1Password found that 45% of those utilizing unauthorized AI cited pure convenience. Because it's just so easy. Exactly. And 43% reported feeling significantly more productive. In the Lenovo research, over 70% of respondents agreed that AI directly improved their personal productivity, the quality of their output, and their creativity.

[00:15:36] There is a really specific feeling you get the very first time you use one of these tools. I mean, you know the feeling. Oh, absolutely. You upload a dense 50-page PDF of dry regulations, right? And you ask the AI to summarize the three things that impact your department. When it does it perfectly, in three seconds, it feels like magic. It's a revelation. You literally cannot unsee that efficiency. Once you have experienced it, the prospect of going back to reading that 50-page PDF manually feels like absolute torture.

[00:16:05] Because you have fundamentally raised your baseline of expectation. And when your expectation is raised, but your employer doesn't meet it, you run straight into the second driver, the provision gap. The provision gap. Meaning the employer isn't providing what you need. Exactly. Employers are demanding high-speed, high-quality knowledge work, but they are not providing the modern tools required to do it.

[00:16:28] Returning to that Lenovo survey, a staggering 22% of AI users stated that their employer provides absolutely no artificial intelligence tools for work. None at all. None. Furthermore, 31% receive no training on how to navigate this new landscape. And even when companies do try to provide something, I mean, it usually feels like a compromised, watered-down version of what you can get on your own phone. Which introduces another layer of the provision gap.

[00:16:54] A RICO study highlighted that 53% of workers felt the approved, officially sanctioned AI tools actually added friction or extra work to their day. Added friction. That's the exact opposite of what it's supposed to do. Right. So if the official corporate tool requires a VPN login, two-factor authentication, and takes a minute to generate a subpar response. Well, the consumer tool on their personal phone takes two seconds and gives a brilliant response. Exactly.

[00:17:21] The provision gap pushes the employee straight back into the shadows. Let me try out an analogy here. It's like being hired to dig a massive trench. Your employer hands you a small plastic spoon and says, get to work. Good luck with that. Right. Meanwhile, you have a brand new state-of-the-art diesel excavator sitting in your driveway at home. You know you are being judged on how fast you dig that trench. Yep. Of course, you are going to wait until the boss turns around, sneak the excavator onto the site, dig the trench in five minutes, and then hide the machine behind a bush.

[00:17:51] You're being malicious. You just refuse to dig with a spoon when a better way exists. That captures the dynamic flawlessly. You are optimizing for the outcome the employer wants, despite the tools the employer provides. Which naturally leads into the third driver, the strategy and communication gap. Okay. How does this one play out? Well, according to Gallup's longitudinal data, only about 25% of employees report that their organization has a clear, articulated plan for artificial intelligence.

[00:18:21] Only 25%. Essentially, yeah. So 75% are just winging it. Essentially, yes. Microsoft's research noted that 60% of corporate leaders worried their own executive team lacked a coherent vision for the future. If the leaders don't have a vision, the employees definitely don't. Right. When the official direction from the top is non-existent, employees have no choice but to improvise their own strategies at the ground level. They become their own IT strategists, basically. Exactly.

[00:18:51] Okay. So we have performance expectancy, the provision gap, and the strategy gap. What is the fourth driver pushing people into the dark? The fourth driver is proactivity and career survival. And this is perhaps the most profound psychological element of the entire phenomenon. Survival. That sounds intense. It is.

[00:19:12] The PagerDuty study revealed that 77% of respondents felt their company's restrictions on AI were actively stunting their professional growth and limiting their future career mobility. Wow, they feel like the company's holding them back. Precisely. Furthermore, 75% stated they would likely look for a new job that offered better access to AI tools and skills development. 75% would look for a new job. Employees are not just adopting these tools to write an email a few minutes faster.

[00:19:40] They are looking at the macroeconomic landscape and they are terrified. Yeah, they believe that if they do not master this technology today, their skills will be entirely obsolete in three years. They view AI fluency as a professional life raft. The waters are rising, the economy is shifting, and they want to learn how to swim. But their employers are standing on the deck of the ship telling them they aren't allowed to inflate the raft. It really is an existential panic. It is survival behavior.

[00:20:09] Now, to truly appreciate the magnitude of the performance aspect, like why these tools feel so much like a necessary life raft, Dr. Westover anchors his argument in a landmark 2023 study. Okay, let's get into this. It was conducted by the Boston Consulting Group alongside researchers from Harvard Business School. In the academic community, this is widely known as the Jagged Technological Frontier Study. I have actually heard whispers of this study, but I want to really understand the mechanics of it.

[00:20:37] Please break down this jagged frontier for us. The methodology of the study is what makes it so compelling. The researchers took 758 highly skilled management consultants at BCG. Okay, so top-tier knowledge workers. Exactly. These are people who are already performing at the peak of their profession. They divided complex knowledge work tasks into two distinct categories. The first category consisted of tasks that were deemed inside the frontier. What does that mean?

[00:21:05] This means tasks that large language models are currently very proficient at, such as creative ideation, drafting reports, and summarizing vast amounts of text. The stuff AI is famously good at. Right. When the consultants were given access to GPT-4 to complete these tasks inside the frontier, the results were paradigm shifting. The AI-assisted consultants completed 12.2% more tasks overall. Okay. A nice bump. They worked 25.1% faster. A quarter faster.

[00:21:34] Mm-hmm. That's huge. But most importantly, the quality of their work, graded by blind evaluators, was rated more than 40% higher than the control group. Wait, I want to pause and just sit with that number for a second. A 40% jump in quality. It's astounding. We aren't talking about a factory line producing widgets a little bit faster. We are talking about human cognition, strategic thinking, complex communication.

[00:22:00] To achieve a 40% leap in quality for someone who is already a highly paid, highly trained consultant, I mean, that is almost unbelievable. It's not a marginal game. No, that is an entirely different league of professional performance. It fundamentally rewrites the expectations of what a single human can produce in an eight-hour day. But the researchers designed a trap, and this is where the concept of the jagged frontier becomes critical. A trap. They also assigned the consultants a task deliberately designed to fall outside the frontier.

[00:22:30] Meaning a task the AI is bad at. Exactly. This was a task requiring subtle logical reasoning, complex situational awareness, and nuance. Areas where AI models often fail, lose the thread, or confidently hallucinate false information. Okay. So what happened when they used AI for that? For this specific task, the consultants who leaned on AI performed significantly worse.

[00:22:54] In fact, they were 19% less likely to produce the correct answer than the control group of consultants who relied solely on their own unassisted human brains. Wow. Okay. I think I have another analogy to visualize this jagged frontier. Let's hear it. Let's say using generative AI is like driving a high-performance Ferrari. Okay. If you are driving on a straight, freshly paved, multi-lane highway, which represents the tasks inside the frontier, like summarizing a document, you are going to absolutely dominate the race.

[00:23:24] You are 25% faster and 40% better. You feel invincible. Yes. But if you accidentally veer off that paved highway and drive straight into a deep, muddy swamp... Outside the frontier. Right. Tasks outside the frontier, like nuanced logical reasoning. Your Ferrari is going to sink immediately. You are 19% less likely to survive the swamp in the Ferrari than if you had just gotten out and walked. The visual of the Ferrari in the swamp is incredibly apt. Definitely.

[00:23:52] And if we apply that analogy to shadow AI, we reveal the core danger. Which is? Because employees are operating in total secrecy, terrified of being caught, they have no map. They have no training from their IT department. No one is putting up road signs to tell them where the paved highway ends and where the swamp begins. Oh, that's such a good point. So they don't even know the frontier is jagged. All they know is that they have a Ferrari. And it goes incredibly fast.

[00:24:17] So they apply the AI to absolutely everything they do, assuming the tool is just as flawless at complex logical analysis as it is at, you know, drafting a polite email to a vendor. And if thousands of employees are driving a Ferrari blindfolded at 100 miles an hour, eventually there is going to be a massive pileup. It's inevitable. Which provides the perfect logical bridge into our next major area of exploration. We need to look at the real world damages of these inevitable crashes.

[00:24:45] We need to examine the hidden costs of this secret workaround. And they are substantial. Yeah. The source material categorizes these into financial, security, opportunity, and psychological costs. Let's start with the hardest data, the financial and security costs. When that blindfolded Ferrari hits a wall, what does the repair bill look like?

[00:25:07] To quantify the damage, Dr. Westover relies heavily on the 2025 cost of a data breach study conducted by the Ponemon Institute in collaboration with IBM. Okay. Highly reputable data. Very. And 2025 was a watershed year for this report as it was the first time they deeply investigated the specific role of artificial intelligence in corporate security incidents.

[00:25:29] Out of the 600 global breached organizations they analyzed, roughly one in five reported that the data breach involved a shadow AI element. One in five major corporate breaches is already tied to secret AI usage? That is a massive footprint for a technology that barely existed in the mainstream a few years ago. It is escalating rapidly. And the financial penalty for having a shadow culture is brutal.

[00:25:55] Organizations that were identified as having high levels of shadow AI activity faced an average of $670,000 more in breach costs compared to organizations that had low or no shadow AI involvement. Hold on. Let's break that down. A company experiences a breach. If that breach happens to involve an employee's secret AI usage, the company pays almost three quarters of a million dollars extra in damages. Correct.

[00:26:23] Why is the penalty so drastically higher just because AI is involved? What is actually happening mechanically during these breaches? It comes down to the nature of the data that is being exposed. When employees utilize unapproved public AI tools, they aren't just asking it for generic advice or dinner recipes. Right. Remember, they are chasing that 40% performance boost we saw in the BCG study. To get that level of performance, they have to feed the AI their actual highly sensitive work. Oh, I see.

[00:26:53] The IBM study found that when shadow AI was involved in an incident, customer PII, personally identifiable information, like social security numbers or health records, was compromised 65% of the time. 65%? Yeah. That is compared to only 53% for average non-AI breaches. Furthermore, intellectual property was compromised 40% of the time compared to 33% normally. So we aren't talking about a hacker breaking through a complex firewall. Not at all.

[00:27:22] We are talking about a well-intentioned employee literally taking their company's most sensitive crown jewel data, copying it, and manually pasting it into a browser tab hosted on a public server owned by a third-party AI company. That is the exact mechanism of the leak. The pager duty data provides a startling window into what people are voluntarily handing over. 43% of respondents admitted to sharing internal company emails with public AI tools. Jeez.

[00:27:50] 40% shared confidential meeting notes, 34% shared customer data, and 31% fed financial information or confidential corporate strategies into public interfaces. I mean, if you were a CEO or a board member listening to this, the realization is chilling. Your highly guarded proprietary Q3 financial strategy might literally be sitting on a server farm somewhere being ingested to train the next iteration of a public language model. Which anyone can query. Exactly.

[00:28:21] Your competitive advantage is bleeding out through a thousand tiny cuts made by your own employees who are just trying to be more efficient. But beyond the terrifying security nightmare, Dr. Wessover points out an entirely different category of loss. The opportunity cost. This is a really subtle but damaging cost. Yep. Let's look at the Brynjolfsson study. How does secrecy actually destroy productivity on a macro level?

[00:28:45] This is one of the most profound economic insights in the paper, stemming from a 2025 study by Eric Brynjolfsson and his research team. They conducted an extensive study involving over 5,000 customer support agents who were provided with a generative AI assistant. Okay. 5,000 agents. The baseline findings were impressive. Overall, the AI tool increased issue resolution rates by 14% across the board. Nice.

[00:29:09] However, when they looked closely at the data, they found something remarkable about the lowest skilled, most novice workers. For that group, the AI increased their performance by a mass of 34%. Wait, 34%? Why was it so much higher for the novices? Because the AI was effectively acting as an instant mentor. It had absorbed the communication styles and problem-solving techniques of the top performers and was whispering those techniques into the ears of the rookies in real time. Oh, wow.

[00:29:38] It is a mechanism of knowledge transfer. The AI acts as a sponge capturing the unspoken, tacit knowledge and best practices of the most experienced veterans and then diffusing that wisdom to everyone else in the organization. Exactly. Exactly. But, and this is the crucial caveat that relates to our topic, that magical diffusion of knowledge only happens if the AI tool is an enterprise-wide, shared, and centrally governed platform. Ah, I see where this is going.

[00:30:07] If I am a mid-level manager and I am secretly using a public AI tool on my personal laptop to become the most efficient worker in my department, I am hoarding all of that efficiency. You're keeping it to yourself. Right. The AI is learning my workflow, but no one else in the company benefits from it. Precisely. Shadow AI completely short-circuits the diffusion of knowledge. It traps these massive generational productivity gains inside individual isolated silos.

[00:30:35] The individual employee looks like a superhero, but the organization captures none of the underlying learning. You end up with islands of incredible secret efficiency, while the company as a whole remains stagnant and fails to evolve. So as an organization, you are bleeding your most sensitive data to the public internet, and simultaneously, you are losing the macro productivity gains to internal secrecy. It's a lose-lose scenario. Completely.

[00:31:03] But I want to pivot and look at the emotional toll this takes on the human beings involved. Let's examine the psychological cost. We established earlier that people feel driven to use these tools to survive. But what does the daily reality of that deception actually feel like for the employee? It creates a highly corrosive internal environment. The 2024 Microsoft data reveals that 52% of AI users are reluctant to admit to their managers that they use AI for their most important tasks.

[00:31:33] Over half are hiding it. Yeah. Concurrently, 53% harbor deep anxieties that using AI will make them look replaceable in the eyes of leadership. So they are constantly stressed. The psychological burden here is immense. The employee is doing the demanding cognitive work of learning a brand new technological paradigm while simultaneously managing the chronic, low-level anxiety of hiding that effort from their boss. Okay, I have to pause and push back on the logic there because it feels kind of paradoxical.

[00:32:03] How so? Well, if an employee is genuinely terrified that revealing their AI use will prove to their boss that a machine can do their job and therefore make them a prime target for layoffs, why take the risk in the first place? If the fear of replacement is that high, why not just do the work manually and protect the illusion of your own indispensability? It is a paradox for sure, but it makes perfect sense when you understand how human beings weigh competing fears.

[00:32:29] They are balancing a long-term, abstract fear against a short-term, acute fear. Oh, I see. Yes, they fear long-term structural replacement by automation, but in the immediate short term, like today, this afternoon, they are absolutely terrified of drowning in busy work, missing their quarterly targets, and falling behind their peers who they suspect are already secretly using AI to get ahead. That makes so much sense.

[00:32:55] They accept the chronic anxiety of concealment in order to secure the immediate, desperate relief of efficiency. Exactly. It's about surviving today's inbox, even if it risks tomorrow's career. Wow. If you are listening to this right now on your commute, you might have felt that exact pit in your stomach, that desperation for relief.

[00:33:17] We saw in the Lenovo data that 79% of people stated they would enjoy their jobs significantly more if they could just offload their administrative tasks. They are starving for that relief. But this dynamic breeds a lot of resentment. The PagerDuty study noted that 81% of employees believe leadership follows a different set of rules entirely. So it fosters a deeply toxic us-versus-them paranoia within the corporate culture.

[00:33:43] And if the psychological friction, the loss of shared productivity, and the three-quarters-of-a-million-dollar breach costs aren't enough to force a change, there is a massive legal hammer descending on the corporate world. Oh, right. The legal aspect. Under Article 4 of the European Union's Artificial Intelligence Act, which was enacted in early 2025 and sees mandatory national enforcement begin in August 2026,

[00:34:09] organizations are legally required to ensure an adequate level of AI literacy among their staff. Meaning they have to prove their staff knows what they're doing. Exactly. If a company operates in the dark and doesn't even know what tools its employees are secretly using, it is legally impossible to prove to a regulator that the staff is literate and safe in using them.

[00:34:30] So, to summarize the current state of play, your company is legally exposed to European regulators, financially exposed to massive breach penalties, your proprietary data is leaking onto public servers, and your employees are isolated, paranoid, and resentful. It's a pretty bleak picture. Yeah. If you were an executive looking at this reality, especially if you just paid that $670,000 breach premium, the most natural knee-jerk reaction is to just pull the plug. Ban everything.

[00:34:59] The instinct is always to ban. Block the URLs at the firewall level, confiscate the devices, and threaten to fire anyone caught using ChatGPT on company time. But Dr. Westover's research argues that leaning into prohibition is the absolute worst strategic move you can make. It is entirely counterproductive. This is where the narrative really pivots. Let's look at the transition from prohibition to provision and governance. Why doesn't banning it work? This is where the narrative really pivots.

[00:35:27] Let's look at the transition from prohibition to provision and governance. Why doesn't banning it work? The paper looks back at 2023 as the year of the great corporate panic and the subsequent bans. Major global players like Samsung, Apple, and Verizon all instituted strict prohibitions on generative AI. Right. I remember that. Samsung, as a prime example, dropped the hammer after an engineer famously pasted highly sensitive proprietary source code into ChatGPT to check for errors,

[00:35:56] accidentally leaking it to the public model. You can entirely sympathize with the executive panic that led to those bans. I mean, totally. When the pipe bursts, the first instinct is to shut off the main water valve. But corporate bans on artificial intelligence are playing out exactly like the prohibition of alcohol in the 1920s in the U.S. A perfect analogy. Banning alcohol didn't eliminate the human desire to drink. It merely pushed the consumption into unregulated, dangerous underground speakeasies where the liquor could make you go blind.

[00:36:26] Yep. By banning AI, these companies didn't stop AI usage. They just created digital speakeasies in every single department. They forced the behavior off the monitored corporate network and onto the personal smartphones sitting right next to the corporate keyboards. The speakeasy metaphor is incredibly accurate. Prohibition addresses the visible symptom but leaves the underlying desperate demand entirely intact. Right. To move past this failed model, Dr. Westover outlines five evidence-based steps.

[00:36:54] Step one is the foundational prerequisite for everything else. Provide sanctioned alternatives. You cannot close the speakeasy until you open a safe, well-lit legal establishment for them to patronize. Exactly. So what does opening a safe establishment actually look like for a modern enterprise? Look at the strategy deployed by organizations like JPMorgan Chase shortly after the initial industry panic. They recognized the demand and didn't resort to permanent bans.

[00:37:22] Instead, they built the LLM Suite, which is an internal generative AI platform that leverages third-party models but is wrapped in enterprise-grade data protection. Oh, nice. They onboarded 100,000 employees rapidly and now boast a quarter of a million active users. Walmart took a similar path, building My Assistant for 50,000 of their non-store corporate workers. Okay, so building internal tools.

[00:37:46] Or buying them, PwC took a different route, becoming OpenAI's first massive enterprise reseller by distributing ChatGPT Enterprise to 100,000 workers. And the key distinction there is the word enterprise. Exactly. By purchasing the enterprise licenses or building internal walled gardens, they secured contractual, legally binding guarantees from the AI vendors that the company's private data would never be used to train the vendor's future public models. Yeah. Basically, close the data leak. Exactly.

[00:38:15] That is the security baseline. However, provision is not merely about signing a procurement contract and handing out licenses. The critical factor is usability. Returning to that RICO statistic, where 53% of employees felt the approved AI tools added friction to the workflow. Right. That represents a catastrophic failure of provision.

[00:38:35] If the safe, corporate-sanctioned AI tool is clunky, slow, and overly restricted, while the banned consumer app is lightning fast and brilliant, human nature dictates that the employees will immediately abandon the safe tool and sneak right back into the digital speakeasy. Makes total sense. The sanctioned alternative must achieve functional parity with the consumer experience, or it'll just be rejected. It has to be good. Okay.

[00:39:00] So you buy the enterprise license and you ensure the interface is actually pleasant to use. But giving someone the keys to a safe Ferrari doesn't mean they know how to navigate the roads. You can't just let 100,000 employees run wild. How are companies actually controlling this without suffocating the innovation? This brings us to step two, risk-tiered governance.

[00:39:25] Dr. Westover directs enterprise leaders toward established frameworks like the NIST AI risk management framework or the ISO IEC 42001 standards. Sounds very technical. It is, but the fundamental philosophy here is just proportionality. Not all artificial intelligence use cases carry the same risk, and therefore they should not be subjected to the same level of bureaucratic scrutiny. Give me an example.

[00:39:48] You cannot logically treat an employee using AI to write a cheerful happy birthday email to a colleague with the same rigor you would apply to an AI drafting a legally binding patient medical record. Which is where a lot of IT departments get it completely wrong. If I am forced to fill out a three-page risk assessment form and wait two weeks for approval just to use AI to format a messy Excel spreadsheet, I am simply going to pull out my phone and use the shadow tool to do it in five seconds. Exactly the problem.

[00:40:16] Intelligent governance categorizes the data and applies tiers to the use cases. Consider Morgan Stanley's approach. They deployed a sophisticated GPT-4 assistant designed specifically for their financial advisors to navigate vast internal knowledge bases. Okay, highly regulated environment. Right, but they didn't just unleash it blindly. They implemented daily regression testing to monitor the model's accuracy. And most importantly, they mandate human accountability.

[00:40:44] The AI can instantly draft a comprehensive summary of a client meeting, but the human financial advisor is absolutely required to review, verify, and finalize the document before it enters the official record. The human is the final backstop. I love that. The source paper also mentions Allen & Overy, the massive global law firm, executing a similar strategy. Yes. Allen & Overy deployed a highly specialized legal AI platform named Harvey to 3,500 of their lawyers.

[00:41:12] But they only moved to full deployment after conducting a massive, heavily monitored beta test involving 40,000 individual queries to map the jagged frontier of that specific tool. They mapped the swamp before they let everyone drive. Exactly. Similarly, Kaiser Permanente rolled out an ambient AI system called ABRIDGE across 40 hospitals. The tool listens to doctor-patient conversations and automatically drafts the medical notes. Wow. That's incredible. But risky. Very risky.

[00:41:40] But it operates under strict risk-tiered rules. It requires explicit documented patient consent and mandatory review by the human clinician. It is about establishing boundaries that are intuitive for the user and directly proportional to the actual risk of the task. But providing a good tool and writing proportional rules only gets you halfway there. As we established with the BCG study, if people don't understand the limitations of the technology, if they don't know the frontier is jagged, they will still end up driving into the swamp. They absolutely will.

[00:42:10] So this brings us to the next major phase of the paper, harvesting the shadows. How do organizations build actual literacy, ensure safety on the ground, and scale these tools across thousands of people? What is the next step? That leads to step three. Role-based literacy. You have to actively train your workforce. And this training cannot be a generic, passive, 30-minute compliance video about what is artificial intelligence. No one pays attention to those. Exactly.

[00:42:37] The UK government ran an extensive trial involving Microsoft Copilot with 20,000 civil servants in late 2024. The results were illuminating. They found that while users saved an average of 26 minutes a day, the benefits were incredibly uneven. Uneven how? The time savings and quality improvements were entirely dependent on the individual user's pre-existing familiarity and active training with AI systems. So when we talk about training for AI, what are we actually teaching them? Is it just prompt engineering?

[00:43:07] Like teaching them the magic words to make the chatbot give a better answer? Prompt engineering is a small mechanical component. But the far more critical cognitive skill is verification. Verification. Harkening back to the jagged frontier, organizations must train their employees on how to spot plausible, highly confident errors. They need to understand the underlying mechanics of how large language models predict text so they can recognize the specific types of tasks where the AI is mathematically likely to hallucinate or fabricate facts.

[00:43:37] You are not just teaching employees to be faster operators of a machine. You are fundamentally retraining them to be cynical editors and critical thinkers. That's exactly it. You are teaching them to inherently distrust the machine's output and double-check the math. That makes total sense. So once they are trained, how do we uncover the secret workflows they've already built? What is step four? Step four is arguably the most psychologically complex hurdle for corporate leadership.

[00:44:05] Creating psychological safety and declaring amnesty. Amnesty. Dr. Westover leans heavily on the foundational 1999 research by Harvard's Amy Edmondson regarding psychological safety in the workplace. If leadership actually wants to map the invisible nervous system, discover what tools people have been secretly using, and understand what tedious workflows have been successfully automated in the dark, they must declare a formal amnesty for past shadow AI usage.

[00:44:34] Okay, I have to stop and push back on this concept of amnesty. Because from a management perspective, it sounds kind of absurd. It's a tough pill to swallow. Right. If I'm a director, and I discover that my subordinate has been recklessly pasting our highly confidential Q3 financial projections into a public chatbot, putting the entire enterprise at massive financial and regulatory risk,

[00:44:58] I am supposed to just give them a hug, tell them they are an innovator and say, thanks for experimenting. The pushback is entirely valid, and it highlights why we must clarify the nuance of how amnesty is applied. Amnesty does not equate to a blanket-free pass for malicious behavior, gross negligence, or intentional corporate sabotage. Okay, that's a relief. An organization absolutely reserves strict disciplinary sanctions for genuine harm or deliberate reckless data leaks.

[00:45:27] However, you must actively forgive and protect the good faith experimentation. Where is the line? Define good faith experimentation in this context. Imagine an employee who utilized a public AI model to rewrite a frustrated, angry email into a polite professional tone before sending it to a difficult client. Or an employee who used a tool to summarize a long, publicly available industry report to prepare for a meeting. Right. Harmless stuff.

[00:45:55] They engaged in shadow AI, yes, but they did it to save time, reduce friction, and ultimately do a better job for the company. They must not be punished. Remember the pager duty statistic we discussed earlier? In the past, 48% of employees who were caught using unapproved AI faced formal corporate discipline. Almost half got in trouble. If you punish the people who were simply trying to be more efficient, you do not stop the underlying behavior. You simply teach the entire workforce to hide their behavior more effectively.

[00:46:23] Oh, you just drive it deeper underground? Yes. You construct an impenetrable culture of silence where no one shares their innovations. I understand now. If you bring the hammer down on the small, well-intentioned infractions, the employees will never come forward. You will never find out about the massive systemic vulnerabilities until it is far too late and you are reading about your breach in the news. Precisely.

[00:46:46] You need them to feel safe enough to come forward and say, hey, I know I wasn't supposed to, but I've been using this tool to save 10 hours a week on our supply chain inventory tracking. Because that specific revelation is what leads perfectly into step five, harvest experimentation. That is the ultimate goal. Step five is where the true organizational transformation occurs.

[00:47:07] You take those brilliant, isolated individual workarounds that were born in the shadows and you elevate them into shared, governed organizational assets. Oh, I love that. Dr. Westover highlights an incredible case study from Moderna, the biotech giant that exemplifies this transition. Let's really dig into this Moderna example. What did their transition look like on the ground? When Moderna made the strategic decision to adopt ChatGPT Enterprise, they didn't just turn on the access, send out a memo and walk away.

[00:47:37] They actively, aggressively encouraged their employees to build customized solutions on top of the secure platform. And what happened? Within just two months of deployment, Moderna employees had created 750 custom GPTs. Great. Let's define that for the listener. A custom GPT in this context is a highly specialized, focused AI assistant built to do one specific task using the company's internal data rather than just a general chatbot. Precisely.

[00:48:05] They built bespoke tools tailored to highly technical workflows. For example, clinical researchers built a tool they called DoseID to assist with the incredibly complex analysis required for clinical dose selection. Wow. The legal and procurement teams built Contract Companion to instantly summarize and extract key clauses from dense legal documents. The brilliance here is the shift in scale.

[00:48:27] Instead of one isolated researcher secretly figuring out how to prompt an AI to analyze clinical data, they built a secure, customized tool that every single researcher in the company can now use safely and efficiently. The organization captured the tacit knowledge. Furthermore, Moderna fostered this culture by creating an active internal forum that rapidly grew to 2,000 weekly active users who were constantly sharing prompts, ideas, and custom builds. They made it a community.

[00:48:56] They designated generative AI champions within different departments. They essentially bypassed traditional slow IT procurement and turned their entire workforce into a massive, decentralized research and development department. They took the chaotic, hidden energy of the shadow and channeled it into a company-wide engine of innovation. That is the ultimate pivot. You transition from fearing the shadow to hunting it down to actually harvesting it for competitive advantage. It's a complete 180.

[00:49:26] Which brings us to the final phase of our deep dive, the outro. Let's assume an organization manages to execute this perfect pivot. They provide the enterprise tools. They establish risk-tiered rules. They train the staff. They declare amnesty. And they start harvesting the good ideas. How do they prevent backsliding? That's the challenge. Right. How do we build durable, long-term capability so the shadows don't just return next year?

[00:49:50] To sustain this ecosystem, Dr. Westover outlines three foundational pillars for long-term success. Pillar one is the concept of living governance. Living governance. Your corporate AI policy cannot be a static 50-page PDF that gets drafted once, approved by legal, and then sits gathering dust on an intranet page. Because the technology changes too fast. The technological landscape is evolving far too rapidly.

[00:50:15] You require a dedicated cross-functional team comprising legal, IT, human resources, and frontline business units that meets continuously. They must assess new tools as they hit the market, review internal discovery data, and adapt the governance rules in real time. Because the language model you thoroughly vetted and approved in January might release an entirely new, unvetted feature set by March that completely changes its risk profile. You have to stay awake at the wheel. Exactly. What is pillar two?

[00:50:45] Pillar two is leadership consistency. We discussed the toxic paranoia revealed in the surveys where 81% of employees believe their executives play by a different set of rules. Yeah, the rules for the but not for me thing. Right. If leadership desires a culture of transparency and trust, the executive suite must visibly, publicly adhere to the exact same data protocols as the entry-level interns. But it goes deeper than compliance.

[00:51:10] Leaders must actively support the users and honestly, empathetically address the existential fear of replacement we discussed earlier. You have to talk about the elephant in the room. If management does not provide employees with a credible reason to believe that AI will elevate their roles rather than eliminate their jobs, the employees will continue to hide their evolving skill sets out of self-preservation. You have to prove to them that the AI is a tool for their success, not a scout for their replacement. Exactly. And pillar three.

[00:51:38] Pillar three is measuring what matters. Organizations must abandon the outdated metrics of the software era. You cannot measure the success of an AI rollout by simply counting how many enterprise licenses were activated or how many employees clicked to the end of a mandatory compliance video. Right. Right. Because that doesn't mean they're actually using it well. No. You must measure tangible value. Are production cycle times actually decreasing? Is the measurable quality of the output improving?

[00:52:07] And crucially, you must measure trust. Trust. Do employees feel psychologically safe enough to voluntarily disclose when they discover a new AI use case? Or more importantly, do they feel safe enough to report when they make a mistake using one? Wow. It requires a complete paradigm shift in how we manage both technology and human psychology. But as we prepare to wrap up this deep dive, I want to pull on one specific, easily overlooked detail hidden near the end of Dr. Westover's text.

[00:52:37] Oh, the final thought. Yeah. I think it holds massive paradigm-chattering implications for the future of work. Throughout this entire hour, our conversation has been predicated on the concept of chatbots. We have been discussing a conversational model. A human being types a prompt, and an artificial intelligence generates an answer or a draft. Right. The human is always initiating the action, and the AI is merely responding with text or analysis.

[00:53:04] But the paper briefly, almost quietly, touches on the looming evolutionary leap from conversational chatbots to autonomous AI agents. And this is the final mind-expanding provocation I want to leave you, the listener, with today. If corporate leadership currently thinks it is a massive headache that employees are secretly using chatbots to quickly draft polite emails or summarize PDFs,

[00:53:30] what happens 12 to 18 months from now when those same desperate employees start deploying unsanctioned AI agents? That specific evolutionary leap is precisely what keeps enterprise security professionals awake at night staring at the ceiling. Let's truly imagine the mechanics of this future state. Contrast the AI we have today, which is a tool that gives advice, with an agentic AI, which is a tool that takes action. A huge difference.

[00:53:58] Imagine a shadow AI that isn't just sitting passively in a browser tab waiting for your question. Imagine a highly capable software agent that you, the stressed employee, secretly authorized to connect to your corporate inbox. You give it a set of parameters, and you go to sleep. Just let it run. While you are sleeping, this unsanctioned agent actively reads an incoming email from a vendor, decides the vendor's request is valid based on past history,

[00:54:27] automatically logs into the corporate financial system, cuts a purchase order, authorizes the transfer of funds, sends a reply email to the vendor, and updates the central CRM database to reflect the transaction. All on its own. It executes an entire multi-step business workflow autonomously, and the company has absolutely no idea it exists. The magnitude of the risk scales exponentially.

[00:54:53] When an AI transitions from generating text to executing transactions, the potential for catastrophic failure multiplies. It's terrifying. If a conversational AI hallucinates, you get a badly written paragraph that a human might catch. If an autonomous agent hallucinates, it might accidentally delete a database, authorize a fraudulent wire transfer, or alter back-end code in a way that cascades through the entire corporate infrastructure.

[00:55:18] If we do not establish the foundational trust, the role-based literacy, and the governed capability right now, today, while the tools are still relatively contained, the next wave of shadow AI will not just be offering secret advice, it will be taking unmonitored action. And if an ungoverned, secret agent takes a catastrophic, hallucinatory action on behalf of your company while you sleep, that $670,000 data breach cost we analyzed today is going to look like a trivial rounding error. Absolutely.

[00:55:48] The imperative to rebuild the diagnostic visibility of the organization is immediate. Which brings our exploration full circle. Right back to the central thesis. The diagnostic landscape of the modern workplace is currently murky. The mechanisms of visibility are broken. But what the synthesis of this research definitively proves is that you cannot fix the underlying system by simply yelling at the employees who are trying to survive it. You can't just punish your way out of it. No.

[00:56:16] You must seek to understand the structural friction causing their pain, provide them with robust, modern tools they require, and create a culture safe enough to bring their hidden innovations out into the light. You have to embrace the shadow. You have to embrace the shadow to illuminate the future of the company. Thank you for joining us on this deep dive into the hidden mechanics of the modern workplace. Take a hard look at your own daily workflows. Think about the tools you rely on to survive the week. And maybe double check what is currently running in your background tabs.

[00:56:46] We will see you next time.