46.2% of security leaders say their most recent AI-tool approval took two weeks or more. 49.3% of workers say they'd use an unapproved tool rather than wait that long.
A marketer requests approval for a new AI writing tool on a Monday. The ticket sits in a queue behind a dozen others. By Friday, with a deadline closing in, she opens up a free personal account instead to get the work done. None of this is visible to security or IT.
Neon Cyber's research into 169 security and IT leaders, paired with a companion survey of 227 knowledge workers, suggests this scene is happening more often than not. Asked what employees would do if an AI tool they wanted wasn't approved fast enough, both sides of the survey answered in the same directional way:
- Use a personal or uncredentialed account: security expects 68.0%; workers admit 57.3%.
- Copy work data into a personal AI tool: security expects 59.8%; workers admit 41.9%.
- Use a different, unapproved AI tool entirely: security expects 51.5%; workers admit 49.3%.
Security teams aren't surprised by workers going around policy to adopt an unsanctioned AI tool. If anything, they predict the workaround more often than workers admit to it.
The real surprise insight from Neon Cyber’s research is that 75.1% of security leaders were confident their approval process could keep pace with AI adoption, and 62.1% rated their approval process as easy. But 46.2% of security leaders said their most recent approval took two weeks or more, and 20.7% say it took a month or more.
Enforce at the point of intent, not just at the gate
Workforce AI governance is the set of policies, approval workflows, and enforcement mechanisms an organization uses to manage which AI tools employees can use, with what data, and under what conditions. It's distinct from AI security tooling itself, which is the technical layer that detects and enforces those policies in practice. AI governance built entirely around a pre-approval gate puts the whole policy at the mercy of how fast that gate moves. When it moves slowly, the policy doesn't hold.
The fix isn't removing the gate. There are good reasons to review new AI tools before they're widely adopted. It's adding enforcement at the point of intent — the moment an action is actually taken, like signing up for a new AI application with a corporate identity or using a “free” AI application. By tracking activity at the point of intent, and blocking and logging the action for security to review, the policy will hold regardless of the approval review process.
What this means: A four-week approval process and a zero-tolerance AI policy produce the same outcome in practice: shadow AI use, relocated into a personal account or an unapproved tool that security will never see.
When approval tickets and policy enforcement run in parallel
Point-of-click enforcement doesn't require predicting which AI tools employees will want to use next quarter, or shortening a review process that exists for good reasons. It applies policy at the moment content moves — into a prompt, a form field, an upload — regardless of whether the tool receiving it was on an approved list. The marketer's Friday-afternoon workaround still gets caught, even if the ticket she filed on Monday is still sitting in the queue.
FAQs
Won't point-of-click enforcement just create a different kind of friction?
It shifts where the friction lands. Instead of blocking access to a tool upfront — which the data shows employees route around — it evaluates the specific action being taken, in the moment, against policy. Most legitimate use passes through without an employee ever noticing; only actions that trip a policy trigger any friction at all.
Does this mean we should stop reviewing new AI tools before approving them?
No. Pre-approval review still serves a purpose — catching a genuinely inappropriate tool before it's adopted at all is easier than unwinding it after the fact. The finding argues against relying on that review as the only control, not against having one.
How do we know if our approval process is actually the bottleneck driving workarounds?
Check the timestamps on your last five AI-tool approval requests against how long the requester said they were willing to wait. 41.4% of workers expect a new AI tool approval to take more than two weeks — if your process regularly exceeds that, it's a reasonable bet you're generating some of the workaround behavior this data describes.