[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Human Cyber Risk](/category/human-cyber-risk) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Watch How User Risk Guides People to Approved Tools](/blog/shadow-ai-risks-in-the-wild) Publish date November 8, 2026 {x} minute read # Watch How User Risk Guides People to Approved Tools [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](#) [Free trial](/demo) Written by [Edward Kost](/team/edward-kost) Senior Cybersecurity Writer Edward is a cyber writer with a mechanical engineering background. His work has been referenced by academic institutions and government bodies. Reviewed by [Phil Ross](/team/phil-ross) Chief Information Security Officer Phil is a Forrester Zero Trust Strategist leveraging decades of experience in enterprise cybersecurity architectures. Table of contents Free resource ### [Download now](#) ### It’s 4 pm on a Friday. Do you know which AI tools your team is using? It's late Friday afternoon. A 5 pm deadline is looming, and one of your employees is searching for an AI tool to finish their task on time. They'll either choose an approved tool, or one they signed up for with their personal email. Our short (and humorously exaggerated) video shows what happens when the unapproved AI tool option is chosen, and how User Risk responds. [Take a product tour of User Risk >](https://www.upguard.com/tour) ### **Why shadow AI is so hard to control** Shadow AI is difficult to control because it's difficult to track. You can’t control what you can’t see, and SSO doesn’t see enough. When employees sign up for apps with personal credentials, those logins never touch your identity provider. That can leave up to 50% of the apps your people use completely invisible to you. ## **How User Risk guides teams from unsanctioned apps to approved tools** ### **1. See the SaaS and AI tools your people actually use** [User Risk discovers the SaaS apps](https://www.upguard.com/product/user-risk) and AI tools your people use in the browser, including ones they never signed into with a work account. See each app, its users, and granted permissions.  ### **2. Turn AI policy into everyday behavior ** Your AI policy shouldn’t just sit in a document. With User Risk, the rules you set drive real-time, browser-level enforcement. Set each app to Approved, Tolerated, Nudged, or Blocked, with exceptions for specific teams or people. > The moment an unapproved AI tool is accessed, employees get either a block or a nudge toward the approved alternative, with a way to request access. ### **3. Coach, don’t just block** A “Blocked” message stops one action, but it doesn’t change behavior. User Risk encourages positive behavior change by nudging employees toward approved alternatives while still allowing access requests, so your employees can keep working efficiently without compromising security.  Daily scans then automatically confirm that remedial actions were taken, so you know the fix actually stuck. ## **Shadow AI is likely already inside your business** A looming deadline and a panicking employee reaching for an unapproved AI tool is today's reality. With User Risk, you can maintain control. Guide employees towards approved tools, and prove to the board you're on top of your Shadow AI risk. See which apps and AI tools your people actually use. [Book a User Risk demo >](https://www.upguard.com/product/user-risk) Free resource ### [Download now](#) ## Related posts Learn more about the latest issues in cybersecurity. Human Cyber Risk #### [A Policy Can’t Stop a Paste: Enforcing AI Rules in the Browser](/blog/enforcing-ai-rules-in-the-browser) Your AI policy says no, but the browser doesn’t. Here’s how User Risk stops shadow AI leaks at the moment of action. [](/team/shane-moosa) [Shane Moosa](#) November 5, 2026 Human Cyber Risk #### [How User Risk Finds the Shadow AI Outside Your Directory](/blog/find-shadow-ai-outside-your-directory) Your directory shows the AI tools you approved. Here’s how User Risk finds the ones in your browsers that it doesn’t, before an auditor asks. [](/team/shane-moosa) [Shane Moosa](#) October 29, 2026 Human Cyber Risk #### [Best Shadow AI Governance Tools for Enterprises: Buyer's Shortlist](/blog/best-shadow-ai-tools) Compare top shadow AI governance tools for enterprises, covering key capabilities and how to shortlist the right platform for your organization. [](/team/shane-moosa) [Shane Moosa](#) September 7, 2026 Human Cyber Risk #### [Human Risk Management Platforms: How to Choose the Right Software](/blog/best-human-risk-management-platforms) Protect your workforce with human risk management software that fits. Compare 10 platforms, the features that matter, and how to choose the right one. [](/team/shane-moosa) [Shane Moosa](#) August 31, 2026 Human Cyber Risk #### [AI Assurance: The Third Head of Your AI Governance Watchdog](/blog/ai-governance-to-ai-assurance) AI governance needs three things: policy, enforcement, and assurance. Most organizations have built the first two. Here's why the third one matters now. [](/team/shane-moosa) [Shane Moosa](#) October 29, 2026 Human Cyber Risk #### [How to Mitigate Human Risk in Cybersecurity: A Practical Framework](/blog/how-to-mitigate-human-risk) Security awareness training alone isn't human risk management. Use this seven-step framework to discover, govern, and coach workforce behavior. [](/team/shane-moosa) [Shane Moosa](#) August 25, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)