The risk of driving usage underground, and the case for sanctioned alternatives

Shadow security, and the finding that matters

The relevant research is older than generative AI and better evidenced than anything written about it.

The core finding comes from a 2014 study based on 118 in-depth interviews with employees. Security-conscious staff who cannot comply effectively with a security control devise workarounds, and those workarounds represent the best compromise the staff member can find between getting the job done and managing the risk as they understand it (high). The authors named the phenomenon shadow security, and the design recommendation that follows is the useful part: study the workaround as the starting point for a workable control, rather than treating it as a discipline problem.

The methodological point matters as much as the finding. This is interview research with real employees describing real behaviour, not telemetry from a product measuring the customers of that product. It is one of the few things in this area with a published sampling approach.

Sitting under it is an earlier idea from the same research tradition, the compliance budget. Employees weigh the actual and anticipated costs and benefits of compliance, and the budget available for that weighing is finite (high). The implication for a shadow AI programme is uncomfortable and useful. A control that is disproportionate does not merely fail on its own terms; it spends compliance capital that is then unavailable for controls that matter more. An organisation with ten rules that staff mostly follow is in a stronger position than one with forty that they mostly do not.

How unsanctioned use becomes invisible rather than absent

The systematic literature on shadow IT gives a taxonomy that transfers directly. Causing factors are grouped as enablers, motivators and missing barriers, and unsanctioned use is distinguished from business-managed use by whether it is covert or overt (high).

Apply the taxonomy to a block. Blocking removes an enabler on the managed device. It leaves the motivator entirely untouched, because the motivator is the work the staff member is trying to do. And the enabler is trivially replaced, because everyone in the building has a device the organisation does not manage. What the block reliably changes is the covert-or-overt dimension: use that was visible becomes use that is not.

Peer effects compound it. Research on how employees justify unapproved IT use finds that existing users influence colleagues, and that non-users can be recruited when they perceive an operational advantage (high). Justifications circulate faster than policies do, and a justification that begins 'they blocked it so I use my phone' is a complete and socially acceptable account of the behaviour.

What is not evidenced

It is worth being direct about the limits of the argument, because this manual has spent thirty chapters insisting on it.

There is no peer-reviewed study measuring migration to personal devices caused specifically by blocking a generative AI tool (high, as a negative finding from targeted searching). The general mechanism is well evidenced. The AI-specific step is an inference from it, and a reasonable one, and it is an inference.

The alternative to saying so would be to cite vendor telemetry as though it were research. A large amount of the material circulating on this topic consists of percentages drawn from a vendor's own customer base, measured through that vendor's own product, published by that vendor's marketing function, with no sampling frame, no response rate and no questionnaire. Those numbers can be indicative. They are not evidence of the proposition they are usually cited for, and repeating them with a footnote launders them.

The Australian numbers, with their denominators

A defender will be asked how widespread this is in Australia. The honest answer has three parts.

For businesses, there is an official figure. The Australian Bureau of Statistics reports that twelve per cent of Australian businesses adopted artificial intelligence in the 2024 to 25 financial year, from the biennial Business Characteristics Survey of around seven thousand businesses, with fieldwork from October 2025 to February 2026. Adoption was thirty-five per cent among large businesses, twenty-two per cent among medium, and eleven per cent among small and micro businesses (high). Note that this measures business adoption, meaning the organisation using AI, not staff using consumer tools.

For individual workers, there is no official Australian statistic. The best available is a nationally representative multi-country survey conducted from November 2024 to mid-January 2025, with over forty-eight thousand respondents across forty-seven countries and a published methodology (high on the study). Its Australian workplace figures circulate in two versions with different denominators, one apparently based on all Australian employees and one on Australian employees who use AI at work, and they should not be mixed or quoted without stating which is which (medium). A national capacity study puts Australian worker use of generative AI in the low to mid twenties as a percentage, reported second-hand (medium).

For the university sector specifically, a figure of seventy-one per cent of Australian university staff using generative AI circulates widely, attributed to a survey of over three thousand staff across around seventeen institutions. The primary report could not be located during this build, and the figure is therefore resting on a secondary account (low). It is the most useful number for this manual's audience and it is the least well sourced, which is a common combination and worth flagging rather than concealing.

The teaching point is not any of these numbers. It is that they measure different constructs on different populations, and that a figure of twelve per cent and a figure of sixty-eight per cent can both be accurate about Australian AI adoption because they are not measuring the same thing. Ask for the denominator and the sampling frame before putting any of them on a slide.

The visibility economics

Restate the finding of Part Four in one paragraph, because it is what makes the argument of this chapter more than a preference.

Every instrument in this manual depends on one of three things. The device is in the managed fleet, so an agent can report. The traffic crosses a network the organisation controls, so it can be observed or intercepted. Or a contract exists with the service, so a log can be requested. Where none of the three holds, there is nothing, and Chapter 27 traced that residue from four directions.

Blocking removes none of those dependencies. It changes where the activity happens, and the destination it changes it to is precisely the place where none of the three holds. That is not an argument that blocking never works. It is an argument that a block's effect on the dashboard is not evidence of its effect on the behaviour, and that the two are systematically confused.

The sanctioned alternative as a control

The strongest available intervention for most Australian organisations is not a control in the usual sense. It is making a governed tool easier to reach than an ungoverned one.

The concrete instance in a Microsoft estate is the free work-account chat service with enterprise data protection, available at no additional cost to users signed in with a work identity. Under that protection the vendor acts as data processor under the data protection addendum, prompts and responses are not used to train foundation models, and the interaction is logged and available for retention, discovery and compliance where the subscription supports it (high).

Eligibility is worth checking rather than assuming. The chat experience is included at no extra cost for work or school account users on a listed subscription, and the list includes the academic A1, A3 and A5 plans as well as the enterprise E3 and E5 plans (high).

Two caveats belong in any communication about it, because getting them wrong damages the credibility of the whole message. The included experience is the web-grounded one. The chat that reasons over the organisation's own content through the graph requires the paid add-on licence, so an organisation promoting the free option should not describe it as knowing anything about the organisation's documents unless the user attaches them (high). And web search within it is handled under a different regime, with the vendor acting as an independent data controller for the search queries rather than as a processor, and the European data boundary commitments do not extend to those queries (high). An organisation that promotes 'Copilot is your sanctioned alternative' without saying which one is setting up a support problem and a trust problem at the same time.

The shadow AI lens

Discover, then decide. The sequence that follows is not a project plan and the week numbers in the internal report should not be treated as one. It is a logic, and each step earns the next.

Discover before deciding, because a decision made about an unmeasured population is a guess. Turn on cloud application discovery through the endpoint agent on the managed fleet, filter to the generative AI category, and establish a baseline of which applications are in use, by how many staff, at what volume. Chapter 24 established that this measurement errs low in a knowable direction, which is a useful property: the real number is higher than the one on the screen, and by roughly the amount the estate is unmanaged.

Classify what was discovered. Tag applications as sanctioned, monitored or unsanctioned, on the basis of risk and of whether a governed equivalent exists. This is where a defender earns their keep, because the classification is a judgement about the organisation's work, not about the product's risk score.

Communicate and consult before enforcing. Because the consultation obligation in Chapter 29 exists, and because an unexplained block is the specific stimulus that produces the workaround this chapter is about.

Warn before blocking. Run sensitive information policies in audit, then in warn, and read what they produce. A warn policy is also a training intervention delivered at the moment of the behaviour, which is the only moment anyone is paying attention.

Block narrowly, where the risk is worst and the alternative is clearest, and keep discovering, because the application catalogue changes monthly and a block list is a snapshot.

What makes a block explainable. A block list of three named applications, with a stated reason for each and a named alternative, is a policy. A block list of two hundred categories inherited from a vendor template is a wall. Staff route around walls, and they do it without feeling that they have done anything wrong, because a wall communicates nothing that could be disagreed with. The difference between the two is not technological and costs nothing.

Making the sanctioned tool the path of least resistance. Concretely, and none of this is a communications activity. It is on the browser toolbar by policy. It is on the intranet front page rather than three levels down. It is in the induction. It is in training that names the data classes that must not leave, rather than the tool names that will change. And there is a procurement path, with a known owner and a known timeframe, for the research or teaching workflow that genuinely needs a different product.

If the sanctioned tool is materially worse at the task, none of that helps. Staff will grade it accurately within a week and the promotion becomes a message rather than a control. An organisation that cannot honestly say its sanctioned tool is good enough for the common cases should fix that before it spends effort on enforcement, because enforcement without a workable alternative is the configuration this chapter is warning about.

When blocking is right. The chapter should not be read as an argument against enforcement, and there is a clear Australian counter-example. Following an investigation into a child protection worker's use of a consumer AI service to draft a court report, the Victorian regulator issued a compliance notice requiring the department to direct staff not to use web-based generative AI text tools, to technically block fifteen named platforms by a specified date, to run an ongoing monitoring programme for emerging tools, and to report to the regulator through to September 2026 (high).

That is blocking, ordered by a regulator, as the proportionate response to a specific harm in a specific unit. The argument in this chapter is not against that. It is against blocking as the opening step across an entire estate, with no alternative in place, no consultation, and a dashboard treated as the measure of success.

Last updated 9 August 2026