Why Restricting AI May Create More Risk Than It Prevents

Elena Koryakina is Chief Product & Technology Officer at Parallels, leading product strategy, engineering, DevOps, AI, and infrastructure.

getty

​When organizations talk about shadow AI, the conversation almost always starts with security concerns. Employees using unapproved AI tools can expose sensitive information and create compliance risks that IT teams cannot effectively monitor. These are valid concerns, but they often obscure a more important reality: employees are not adopting AI because they want to break the rules. They are adopting AI because it helps them work faster.

That distinction matters because it changes how organizations should approach the challenge. When leaders view shadow AI primarily as a security problem, the instinct is often to restrict access or tighten controls. However, when they recognize that shadow AI is fundamentally driven by productivity, the conversation shifts from prevention to enablement. Employees are already using AI. The question is whether organizations will provide a safe, governed way to use it.

The Real Driver Behind Shadow AI

AI is moving faster than most organizations can adapt. Powerful tools are available to virtually anyone with an internet connection, and employees can start using them immediately without formal training. They can access AI capabilities immediately and see results right away. Enterprise adoption reflects this momentum, with McKinsey reporting AI use in at least one business function has grown from 78% to 88% of organizations in the past year.​

The appeal is obvious. Developers can write code faster, marketers can generate content more efficiently, analysts can summarize information in minutes, and customer-facing teams can respond to requests more quickly. Microsoft's research has found that regular AI users report measurable productivity gains, with many saving more than 30 minutes each workday using AI.

When employees experience these benefits, they naturally incorporate AI into their daily work. And they are doing this faster than organizations can establish governance frameworks around them.

Why Restriction Often Creates More Risk

Many organizations respond by limiting access to AI tools or requiring lengthy approval processes before employees can use new technologies.

While well-intentioned, these approaches rarely change behavior. Employees are still expected to solve problems quickly and deliver results. When approved options are unavailable or difficult to access, many will simply seek alternatives outside official channels.

The result is counterproductive. Restrictions intended to reduce risk often push AI use into environments where organizations have even less visibility and control. Instead of using sanctioned tools that can be monitored, employees turn to tools that operate entirely outside the organization's security framework.

Excessive restrictions can also create strategic disadvantages. AI is increasingly becoming a competitive advantage, enabling faster innovation, greater efficiency and quicker delivery of products and services to market. Companies that slow adoption too aggressively risk falling behind competitors that are enabling their employees to use AI safely.

Why Traditional Security Models Are Struggling ​

Part of the difficulty stems from the fact that AI does not fit neatly into traditional security frameworks. Most cybersecurity strategies were designed around relatively stable environments consisting of known applications, managed endpoints and predictable network boundaries.

AI changes those assumptions. New models, services, integrations and AI-powered agents emerge at an extraordinary pace. Employees can interact with AI through browsers, cloud services, APIs, embedded assistants and countless other channels. The number of potential entry points expands, making it increasingly difficult for security teams to maintain visibility.

At the same time, security teams must also consider how data is being shared, processed and retained across a rapidly evolving ecosystem of AI services. Controls designed for traditional software environments are often insufficient for managing AI-driven workflows because they were never built to manage the speed, scale and complexity of modern AI adoption.

Shadow AI Is Different From Shadow IT

Shadow AI resembles shadow IT, but the risks are fundamentally different.

Traditional shadow IT centers on unauthorized applications or services. Shadow AI centers on data. Every prompt submitted has the potential to include sensitive information, intellectual property, customer data or internal business knowledge. Because these interactions occur within normal workflows, they are often difficult to detect using traditional security tools.

Organizations must shift their focus from controlling applications alone to understanding and governing how data flows through AI environments.

Safe Enablement Must Become The Goal

The most effective organizations will recognize that AI is now part of the modern workplace and will focus on creating environments where employees can use it safely rather than preventing them from using it altogether.

Governance should emphasize visibility, data protection and guardrails that operate within the flow of work instead of creating barriers employees are motivated to bypass.

Safe AI enablement starts with practical steps. Organizations should provide employees with approved AI tools that meet enterprise security standards, establish clear guidelines for what information can and cannot be shared with AI systems and deliver practical training on responsible AI use. Security controls should protect sensitive data automatically, allowing employees to work efficiently without relying on complex policies or manual oversight.​

This approach is increasingly aligned with how organizations are thinking about AI more broadly. According to recent survey from our company, 58.1% of respondents identified security monitoring as their top AI priority, highlighting the growing need for visibility and governance rather than limiting AI adoption.

Shadow AI is often framed as a cybersecurity challenge, but that view misses what is really driving adoption. Employees are embracing AI because it helps them work faster and more efficiently.

The organizations that will succeed are those that make the secure way to use AI the easiest way to use AI. By combining trusted tools, clear governance, employee education and built-in security controls, organizations can reduce risk while giving employees the confidence to use AI productively at scale.

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?