In an earlier post, I wrote that AI transformation needs three factors: technology, people and security. If one is missing, there's no impact. Today I want to look at a pattern I'm seeing in almost every organization right now. It concerns people, and surprisingly often the solution lies with security.
Between euphoria and fear
It feels like we're currently moving along a line between two extremes.
On one side are the AI enthusiasts. They try everything, right away and everywhere. They are valuable for any organization because they show what's possible and pull others along. But they rarely think about security. Data ends up in tools nobody has approved, and often not even management knows about it.
On the other side are people who don't use AI at all. They don't trust themselves to, their knowledge isn't there yet, or there are fears: of doing something wrong, of breaking a rule, or that their own work will lose its value. This reluctance is understandable. For the organization, it still leads to standstill.
Both extremes are a risk. One leads to shadow AI, the other means the investment in AI never lands. And often both exist in the same organization, sometimes even in the same team.
Why banning and letting it run don't help
Many organizations react in one of two ways. Either they ban everything for now until a policy is in place. The enthusiasts then switch to private tools, and the hesitant feel confirmed that AI is dangerous. Or they let it run. Then shadow AI grows, and the reluctant stay where they are.
Either way, the dial moves further toward the edges.
Guardrails and a foothold
Well-calibrated security can bring both sides to the middle. For the enthusiasts, it provides guardrails. There is an approved tool, and it's clear which data may go into it and which may not. The energy is kept and gets a direction.
For the hesitant, the same framework provides a foothold. Anyone who knows what's allowed doesn't need to be afraid of doing something wrong. This includes room to experiment, first concrete use cases and a contact person for questions. That's how "I don't dare" turns into a first attempt.
In this picture, security isn't a brake but what makes movement possible. After all, a car has brakes so that you can drive fast.
A question for you
Where are your employees on this dial? And does your security framework help both sides today, or does it mostly scare people off?