AI tools have made it remarkably easy for a company to expose its own data:
- An employee pastes a customer list into a chatbot to reformat it.
- A developer drops proprietary code into an assistant to debug it.
- Someone connects a new AI product to their work account to save a few hours a week.
None of these actions seem malicious, but each one moves sensitive information somewhere the security team cannot see.
This new era of “move fast and break things”, a phrase famously coined by Mark Zuckerberg in the early Facebook days, benefits attackers. Company data now flows through more places, more third parties, and more delegated credentials.
Shadow AI is already widespread:
- 82% of organizations have discovered at least one AI tool or workflow that security and IT did not know existed.
- 90% of IT leaders say they are concerned about shadow AI from a privacy and security standpoint.
Organizations know this is a problem and will enact an AI policy to educate employees about acceptable AI use and satisfy compliance requirements. The assumption is that if employees know the rules, they will follow them. Unfortunately, governance does not work that way.
An policy document and employee training are just the beginning of an AI governance strategy. AI policy only works when it’s backed by visibility and technical controls enforced within user workflows.
A real-world shadow AI-driven incident
In April 2026, Vercel disclosed that an attacker had reached internal systems through a third-party AI tool. Here’s what happened:
An employee signed up for a consumer AI product using their corporate Google Workspace account.
- That employee granted broad permissions during self-service signup.
- That vendor was breached months later.
- The attacker used the stolen OAuth token to take over the Workspace account and reach sensitive company environments.
The risk wasn’t the AI tool itself. It was the absence of controls around how it connected to corporate accounts.
The problem: Policies buckle under delivery pressure
The instinct after an incident like this is to reinforce policy more frequently. But the evidence tells a different story:
- Employees intentionally circumvent policy: A Gartner survey of 1,310 employees found that 69% had bypassed their organization’s cybersecurity guidance in the previous 12 months, and 74% said they would be willing to bypass it if doing so helped them or their team hit a business objective.
- Employees often forget what training covers: Two large studies on anti-phishing training, one at UC San Diego Health with more than 19,500 employees and a reproduction at a US fintech firm with over 12,500, found that training barely changed whether people clicked on phishing emails.
IT operations teams run into these same issues when trying to get software engineers to follow written security requirements. Delivery pressure for these engineers would override following policies all the time.
AI adoption follows the same pattern. When policy becomes a barrier to productivity, productivity will win.
The fix: Encoding policies in a “paved road”
What eventually worked in the IT operations field was encoding the safe path into the tooling developers already used. Jason Chan, the former VP of Information Security at Netflix, popularized the shorthand that stuck: paved roads and guardrails, not gates.
While a gate is effective at stopping something in the moment, it can often motivate people to find an unsafe, unmonitored route to an unsafe action (like shadow AI). A guardrail is better because it still acts as a technically enforced boundary, but it also shows users an alternative path that’s safer.
Successfully encoding AI governance policies starts with discovering those initial unsafe, unmonitored routes and understanding the user needs that created them.
The first step is always discovery
You cannot govern what you cannot see, so effective AI governance begins with visibility. However, the harsh truth is that many organizations still don’t know which AI tools employees use, what data is being shared, or where that data ends up. You can’t apply a control to activity you haven’t seen, so the first step is to shine a light on the AI happening in the shadows and use that data to inform your governance strategy.
Discovery has to cross boundaries because the activity does. The three main signals to start with are:
- Browser sessions
- Local device processes
- Network calls (especially from unmanaged devices)
Once AI agents are being used frequently in your organization, delegated credentials to those agents are a fourth signal you’ll need to follow.
Your AI inventory is wider than most policies assume since risk comes from more than just chatbots. You also need to track:
- Various types of AI applications
- AI features shipped into SaaS applications your organization has already approved
- Autonomous AI agents
You’ll need to scan for these AI inventory items continuously, then aggregate the data in the same dashboards and reports your IT or security operations team opens every day. Ideally, that single view includes:
- AI usage
- Risk scoring
- Policy status
- Recommended actions
Resist solutions that put findings in a separate console or outside established incident workflows. AI policy violations need to be visible in the main view that is frequently checked so they can be prioritized and investigated like any other security signal.
Lastly, the ongoing discovery function should include a requirements-building function. Every unsanctioned action in your discovery report marks a place where the approved path didn’t meet user needs. Look for patterns and talk with AI users to compile a list of guardrail-design inputs rather than a list of offenders.
How to effectively enforce AI policy
The most common mistake in AI enforcement is treating it as binary: block or allow. But blocking too much without any recourse is the fastest way to push usage onto personal devices and personal accounts, where you have no visibility at all. In practice, most decisions should fall into three states, rather than two:
- Allow approved tools for defined users and groups.
- Warn when something carries policy or risk concerns, offer other options.
- Block what should not happen under any circumstance, redirect to other options.
The warn tier can be a user-facing message at the moment of action, a notification to an administrator, or both. It gives organizations visibility and coaching opportunities without immediately disrupting work, and it helps security teams guide behavior while evaluating new tools and emerging use cases.
The block tier requires some nuance as well. When a block is applied, explain why. Employees are more likely to follow policy when they understand what triggered the action and what approved alternatives exist.
IT and security teams should work with employees on new tools. Apply a safe proof of concept approach, evaluate the risks, and determine whether a tool can be adopted safely rather than simply maintaining a growing list of blocked applications. The answer to AI uncertainty is adaptability, not paralysis.
Three control points: what each one covers
Effective AI governance typically requires visibility and control across three key control points. They’re the same three surfaces that the discovery function focuses on:
| Control point | What it observes | What it can enforce |
|---|---|---|
| Endpoint detection and controls |
|
Tool and application access by user and group, including local agents and desktop AI clients. |
| Network/Firewall |
|
Service-level access, including paths that never touch a managed browser or a managed endpoint. |
| Secure browser and workspace protection |
|
Uploads, downloads, copy and paste, and screen captures inside a managed browser. |
User identity and session context are also critical signals for evaluating AI activity. Many modern incidents begin with the compromise or misuse of legitimate credentials rather than malware. The Vercel breach demonstrates how quickly a trusted identity can become the starting point for a larger security event.
One policy in one place
Everything in your AI governance program, from the discovery inventory to the policy definitions, controls, and enforcement logs, should be visible and manageable through a shared operational view. No switching between disconnected consoles.
When visibility and controls live together, organizations can move more quickly from detection to action, maintain more consistent policies, and provide a single source of truth for monitoring, investigation, and enforcement.
What building the AI governance “paved road” looks like in practice
When an unknown or unapproved AI tool is discovered, organizations should follow this sequence:
- Detect: Signals from the endpoint, the network, and the browser surface the activity.
- Classify: A service nobody recognizes lands in a review queue. Your preference may be to block by default with a message explaining that the tool needs to be evaluated.
- Assess: Evaluate on identity, permissions, geography, data access, and behavior, not on the tool’s name alone.
- Decide: Set an allow, warn, or block enforcement policy in your security system, scoped to the users and groups it applies to.
- Enforce: The next time an employee reaches for that service, apply the decision at the moment of use on whichever control point the activity crosses.
- Redirect: If the policy is to block this service, include a message with a named alternative and a visible route to request an exception.
- Route: Send the event into the detection and investigation workflows the team already runs, so an enforcement event can become an investigation when it needs to be.
Many organizations are still building capabilities across the early stages of this process. Effective AI governance strategy requires all seven.
AI visibility to AI control and protection flow.
Make the wrong thing hard and the right thing easy
Boards, cyber insurers, regulators, and auditors increasingly expect the same level of visibility into AI usage, risks, and policy compliance that they demand across the rest of the security program.
Instead of scrambling to assemble that evidence when questions arise, organizations should be able to quickly demonstrate what happened, which policies applied, and how those policies were enforced during a defined time period.
An effective AI governance strategy relies on two key enforcement best practices:
- Make it difficult to do the damaging thing, through blocks applied where the activity actually happens.
- Make it easy to do the safe thing, through:
- Warnings that explain themselves
- Redirects to approved alternatives
- An exception path people can find
The written policy defines the rule. The control is what makes the rule true.
The key to effective AI governance is applying visibility and enforcement through the control points organizations already operate across endpoints, network, and browser layers. Most dedicated AI security platforms require significant resources to deploy and manage while also adding one more standalone console. If AI governance data ends up somewhere your team does not already look, it will not get looked at.
That is the thinking behind Sophos AI Defense. It helps organizations see AI, control AI, and secure AI using the security controls they already operate across endpoints, networks, browsers, and managed detection and response. Rather than introducing another standalone tool or console, it brings AI visibility, policy enforcement, and protection into the cybersecurity operations teams already use every day.
Further reading
See how AI policy enforcement looks in action:
About Author
