[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Human Cyber Risk](/category/human-cyber-risk) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Guiding Staff From Shadow AI To Approved Tools With User Risk](/blog/guiding-staff-from-shadow-ai-to-approved-tools) Publish date November 12, 2026 {x} minute read # Guiding Staff From Shadow AI To Approved Tools With User Risk [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/the-state-of-shadow-ai) [Free trial](/demo) Written by [Shane Moosa](/team/shane-moosa) Content Writer Shane is a cyber writer with a software development background. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents Report The State of Shadow AI - Trends, Insights & Statistics Free resource ### The State of Shadow AI - Trends, Insights & Statistics [Download now](/resources/the-state-of-shadow-ai) Picture a road closed overnight for construction. There’s a barrier and a “Road closed” sign, but no detour sign or arrow. As 8:00 AM traffic backs up, drivers cut through a school parking lot or a residential street, routes nobody planned for. These drivers aren’t trying to break the rules; they need to get to work on time. Most AI policies have the same problem. They’re clear about what people can’t use, but rarely say what they can use in the moment.  So, when someone on a deadline hits a “no,” they do what the drivers do: find their own way around. Usually that’s a free AI tool on a personal account, with company data along for the ride. In a regulated business, every detour is an unvetted vendor. Blocking tells people where they can’t go; guidance shows them where they can. User Risk does both the moment someone opens a tool in the browser. ## Why “no” on its own sends people looking Most people want to follow the policy, but convenience wins. In UpGuard’s[ 2025 State of Shadow AI research](https://www.upguard.com/press/new-research-from-upguard-reveals-68-of-security-leaders-admit-to-unauthorized-ai-usage), only 52% of employees said they were familiar with their company’s AI usage policy. Employees who received AI safety training were the ones using unapproved tools most often. So even trained employees take the fastest route. If nobody has put an approved alternative in front of them, the fastest route is an unapproved tool. Training can name the approved tool once. It can’t be there when someone’s choosing. That makes timing the real gap. Left to a policy and a “road closed” sign, AI governance breaks down in three places: **Nobody knows what’s approved.** Employees need a tool now, not after someone replies hours later. If the answer lives in an onboarding PDF, an intranet page, or a colleague’s memory, the faster (and usually unapproved) option wins. **A block with no alternative starts a search.** A network block shows an error page and nothing else. The task still needs doing, so people try the next tool, then the next. **You can’t tell if the message landed.** Training completion tells you who clicked through a module. It doesn’t tell you who switched to the approved tool. Each detour also costs you goodwill. Security starts to look like the “department of no,” and that makes the next detour more likely. We built User Risk to put up the detour sign. ## How User Risk turns “no” into “use this instead” User Risk puts guidance in the browser, through the same lightweight extension that discovers the apps your people use and enforces your policy. *\ ‍*Three User Risk features do the work: * **Real-Time Contextual Nudges** appear when someone opens an app you’ve set to Nudged. They explain why the tool isn’t approved and point to the one that is. Apps you’ve blocked offer the approved alternative too. * **Personalized Security Scores **give each employee their own security rating, updated daily, so they can see the effect of switching to approved tools. * **Automated Validation **runs daily scans to confirm people switched to the approved tool, then clears the risk so you can show leadership the trend. See how [Contextual Guidance](https://www.upguard.com/product/user-risk/contextual-guidance) works, or take a [User Risk product tour](https://www.upguard.com/tour). ### Aubrey’s first two weeks, with and without User Risk Take Aubrey, a new operations coordinator. Here are her first two weeks, once without User Risk and once with it. Same onboarding packet, same deadline on day three. #### Before User Risk **Day 1.** Aubrey signs the AI policy along with a stack of other onboarding documents. Copilot is the approved tool, somewhere on page 12. **Day 3.** She needs a 40-page supplier audit report summarized by lunch. She searches for a free AI summarizer, signs up with her personal Gmail, and uploads the PDF. **Day 4.** On a screen share, her manager mentions the team uses Copilot. Aubrey asks in Teams which other AI tools are fine. Three people give three answers. **Day 8.** The helpdesk gets another “is this AI tool allowed?” ticket. Someone on your team answers it by hand, again. **Day 10.** IT blocks the summarizer at the network after someone spots it. Aubrey’s next task needs a transcription tool, so she finds one of those too. Each time Aubrey hit a wall, she went looking for another tool, because nothing ever said, “try this instead.” #### After User Risk **Day 1.** Same onboarding packet. The User Risk extension is already on Aubrey’s managed laptop. **Day 3.** Aubrey opens the free summarizer. You’ve set it to Nudged, with uploads blocked, so a Real-Time Contextual Nudge appears. It explains in a line why the tool isn’t approved and links straight to Copilot. **Day 3, two minutes later.** Aubrey has her summary from Copilot. The supplier report never reaches the unapproved tool. **Day 4. **Overnight, Automated Validation confirms the day-three risk is resolved. When Aubrey opens the User Risk extension that morning, there’s nothing left to fix. No apps need action, and her score has updated. She doesn’t need to ask in Teams whether she’s doing it right. **Day 8.** Fewer “is this allowed?” tickets reach the helpdesk, because the answer now shows up in the browser. **Day 10.** Aubrey needs a transcription tool. She opens one, gets a nudge, and lands on the approved option. No one had to step in. Aubrey learned the policy where it counts: in the browser, when she needed a tool.  ## Put up the detour sign with User Risk Close a road without a detour, and people find their own way around. Put up the sign, and most of them follow it. People want to do the right thing, but they need the policy to show up while they’re choosing a tool, with a better option attached. That’s how security gets to say “use this” far more often than “no.” Curious what your team would see?** **[**Get a demo**](https://www.upguard.com/contact-sales)**.** *Next in this series: keeping all of this running when you’re the only one managing it.* Report The State of Shadow AI - Trends, Insights & Statistics Free resource ### The State of Shadow AI - Trends, Insights & Statistics [Download now](/resources/the-state-of-shadow-ai) ## Related posts Learn more about the latest issues in cybersecurity. Human Cyber Risk #### [Watch How User Risk Guides People to Approved Tools](/blog/shadow-ai-risks-in-the-wild) Shadow AI is already inside your business. Watch how UpGuard User Risk finds unapproved AI tools, enforces your AI policy, and coaches employees. [](/team/edward-kost) [Edward Kost](#) November 10, 2026 Human Cyber Risk #### [A Policy Can’t Stop a Paste: Enforcing AI Rules in the Browser](/blog/enforcing-ai-rules-in-the-browser) Your AI policy says no, but the browser doesn’t. Here’s how User Risk stops shadow AI leaks at the moment of action. [](/team/shane-moosa) [Shane Moosa](#) November 12, 2026 Human Cyber Risk #### [How User Risk Finds the Shadow AI Outside Your Directory](/blog/find-shadow-ai-outside-your-directory) Your directory shows the AI tools you approved. Here’s how User Risk finds the ones in your browsers that it doesn’t, before an auditor asks. [](/team/shane-moosa) [Shane Moosa](#) November 12, 2026 Human Cyber Risk #### [Best Shadow AI Governance Tools for Enterprises: Buyer's Shortlist](/blog/best-shadow-ai-tools) Compare top shadow AI governance tools for enterprises, covering key capabilities and how to shortlist the right platform for your organization. [](/team/shane-moosa) [Shane Moosa](#) September 7, 2026 Human Cyber Risk #### [Human Risk Management Platforms: How to Choose the Right Software](/blog/best-human-risk-management-platforms) Protect your workforce with human risk management software that fits. Compare 10 platforms, the features that matter, and how to choose the right one. [](/team/shane-moosa) [Shane Moosa](#) August 31, 2026 Human Cyber Risk #### [AI Assurance: The Third Head of Your AI Governance Watchdog](/blog/ai-governance-to-ai-assurance) AI governance needs three things: policy, enforcement, and assurance. Most organizations have built the first two. Here's why the third one matters now. [](/team/shane-moosa) [Shane Moosa](#) November 3, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)