Why the fastest way to get AI into your company is through the security team
Three-quarters of employees are already using AI at work. Security chiefs who build safe on-ramps are winning influence; those who say 'no' are being routed around.
Key points
- McKinsey's 2024 State of AI report found 76 percent of employees now use AI at work, up from 55 percent the year before.
- Most of that use is happening outside any formal review, on personal accounts.
- Security teams that build a fast, sanctioned path to AI are gaining board influence; those that block it are being bypassed.
- The practical fix is a lightweight approval lane, not a lengthy policy nobody reads.
Your staff already made the decision for you. The policy document can wait.
McKinsey's latest State of AI survey, cited this week by The Hacker News, says 76 percent of employees are using AI in some part of their job. A year ago it was 55 percent. Most of that growth is happening without the security team knowing about it.
What does this actually mean for a normal company?
People are pasting work into chatbots. Sales staff drop customer emails into ChatGPT to rewrite them. Finance people ask an AI to summarise a spreadsheet. Developers pull code suggestions from a free assistant. Nurses, teachers, shop managers: same story.
Most of that traffic runs through personal accounts on home devices. The company has no record of what left the building, no way to pull it back, no audit trail if a regulator asks.
The failure mode isn't a dramatic breach. It's a slow leak of customer data and product plans into chat histories the company doesn't own. We've tracked that exact pattern across 18 shadow AI stories since May, and our 15 July piece found that most security tooling can't even see the traffic.
Why blocking it does not work
Security teams have tried the old playbook. Block the domain. Update the acceptable use policy. Send a stern email.
Staff route around it. Phones come out. Work gets forwarded to personal Gmail. Documents get screenshotted and retyped into Claude at home. The post-mortem says the same thing every time: the tool was too useful and the sanctioned alternative didn't exist yet.
Our 17 July story found senior executives are the worst offenders, quietly undermining the policies their own IT teams are trying to enforce. Block-first security doesn't survive that dynamic.
The teams doing well have flipped it. Instead of running the department of no, they're running the on-ramp. Pick two enterprise AI tools with proper data handling, wire them into single sign-on, make them the easiest option on a Monday morning.
What a working AI on-ramp looks like
A few concrete pieces show up in the companies getting this right.
First, an enterprise contract with the AI vendor, so prompts aren't used for training and a data processing agreement is on file. That's table stakes for anything touching customer information under GDPR or HIPAA.
Second, logging. Every prompt and response captured, the way you'd log a database query in CloudTrail or a GCP Audit Log. If your team can't answer what marketing asked the AI about your unreleased product last Tuesday, you don't have governance.
Third, a fast approval lane for new use cases. Two weeks, not two quarters. If approval takes longer than finding a workaround, staff will find the workaround.
Fourth, training that treats staff as adults. Show them what data is fine to paste and what isn't, using examples from their actual job.
Why CISOs should care about the politics
The security leaders getting promoted right now are the ones the CEO calls before an AI project starts, not after. That only happens if security is seen as the group that makes AI possible.
Vendor pitch decks will call this 'AI governance transformation'. Strip the PR and it's simpler: build the safe path, log everything cleanly, and review requests fast enough that staff use the front door.
The burnout risk is real too. Our 20 July story found a quarter of security chiefs considered quitting last year partly because AI pressure has outrun their authority. Owning the on-ramp is one way to fix that imbalance.
If your sanctioned AI tool is harder to use than the free one, you've already lost the visibility fight.
