Workers hide their AI use

In a two thousand twenty-five global study by KPMG and the University of Melbourne, fifty-seven percent of workers said they have hidden their use of AI, and forty-eight percent said they upload company data into…

“57% of workers said they've hidden their use of AI, and 48% said they upload company data into public AI tools.”

Shadow AI use quadrupled

Verizon's two thousand twenty-six Data Breach Investigations report found that shadow AI detections quadrupled in one year.

Companies underestimate tool use

Russell's company helps enterprises discover the SaaS and AI tools their employees actually use. In nearly every deployment, the number of distinct AI tools already in use is several times what the security team believed.

The restrictive policy problem

Restrictive policies themselves can become part of the problem. Employees interpret policies and decide whether to comply or quietly work around them, driven largely by whether they see cybersecurity threats as real and serious.

“Restrictive policies themselves can become part of the problem.”

Policies erode threat perception

Research across six experiments involving more than two thousand eight hundred participants finds that common cybersecurity policies might actually be exacerbating the problem, eroding employees' beliefs that cybersecurity threats are as grave as they are…

Psychological reactance explained

When policies are imposed in ways that make employees feel the organisation is overstepping its control, they experience psychological reactance, which leads them to downplay the seriousness of cybersecurity threats.

Autonomy reduces reactance

When leaders roll out mandatory policies using language and tweaks that preserve feelings of autonomy, the psychological reactance subsides and employees become less dismissive of the threat.

Firewall versus education study

Participants read about everyday apps becoming entry points for cyberattacks.Some read about a firewall policy blocking unapproved apps; others read about education teaching employees to judge app safety.

Solution aversion in action

When people dislike the proposed solution to a problem, they become more likely to deny that the problem itself is serious.

Mandatory training backfires

Participants imagining themselves as consultants read about mandatory cybersecurity training or voluntary attendance. The mandatory version produced more reactance. Participants required to attend reported feeling substantially more bothered and anxious.

Choice within the mandate works

When everyone had to complete training but could choose how, participants reported less reactance and less denial of threats than those with no choice. Giving employees control over compliance reduced reactance and denial.

Samsung's AI policy shift

Samsung banned employee use of generative AI tools such as ChatGPT in two thousand twenty-three after employees uploaded sensitive code to the platform.

Lifting bans sends wrong message

When organisations move from bans to allowing tools, employees may infer that the original danger was never serious.

“They said this was dangerous. Now they are allowing it. Maybe the danger was never that serious.”

Lifted policies reduce threat belief

Employees who recalled a lifted cybersecurity policy were more likely to deny that cybersecurity threats are real.

Reaffirming risk softens the effect

When a company lifted its AI ban while explaining that generative AI could improve efficiency but cautioning that it still posed serious data security risks, employees were less likely to reduce their beliefs in the…

Five principles for better policy

Give employees choice inside guardrails. Make the secure path less aversive. Explain the threat before imposing control. Plan the exit before you impose the ban. Measure beliefs in addition to compliance.

Choice within safe boundaries

Reactance is most likely when employees feel a valued freedom has been taken away.For AI tools, offer a menu of approved platforms rather than blanket prohibition.For training, allow choice among modules, formats, or times.

Treat frustration as security data

Employees use unapproved tools because approved ones are slower, weaker, harder to access, or poorly matched to the work.Leaders should ask what need the policy blocks and meet that need safely.

Build a culture of authentic risk

Employees will continue discovering new tools faster than organisations can formally approve them.The question is whether companies can create a cybersecurity culture in which employees authentically recognise risk and genuinely want to cooperate with management.

“The question is whether they can create a cybersecurity culture in which employees authentically recognize risk and genuinely want to cooperate with management.”