Knowing the Policy Is Not the Decision

An employee at 3 p.m. with a customer contract and a deadline needs to know, in about 30 seconds, whether pasting it into the company’s AI assistant is allowed. A PDF on the intranet does not answer at that speed, so the employee decides alone.

That decision is now routine. Verizon’s 2026 Data Breach Investigations Report found employees regularly using AI on corporate devices jumped from 15 to 45 percent in a year, 67 percent of them through personal accounts. IBM’s 2026 Cost of a Data Breach study tied shadow AI to 43 percent of security incidents, up from 20 percent a year earlier.

Few were trying to cause a breach. I wrote a book about insider threats twenty years ago, and every story in it was someone with legitimate access doing what made sense at the time. The AI version is the same person with a faster tool. You cannot train someone out of a workaround that saves an hour a day, and a UC San Diego study of 19,500 employees over eight months found annual awareness training had no significant effect on behavior.

The Gray Zone Is Where the Risk Lives

Policies describe categories. Decisions happen in specifics. A sanctioned CRM ships an AI summarizer in a release note nobody read, the approval was a point in time and the application kept moving. An enterprise assistant with data residency terms and a no-training clause is a different risk than the same prompt in a personal account on an unmanaged browser, but both look like “using AI” to the employee. A spreadsheet with the names stripped is not anonymous once a job title and a start date share a row with a zip code.

The gray zone is a sanctioned tool, a legitimate task, and the wrong data mix. A June 2026 PagerDuty survey of office workers found 29 percent were unsure whether their AI use was even allowed, and 33 percent said they would hide it. Ambiguity does not produce caution. It produces silence.

Build the Program Out of Decisions

“Do not share confidential information with unauthorized AI systems” is a rule. “Can I paste this customer email into Gemini to draft a reply?” is a decision, and it trains a different part of the brain. Build the program out of decisions.

Data classification comes first. An employee who cannot tell what is sensitive will not protect it under deadline. Then write the scenarios your people actually face such as the customer thread into the enterprise summarizer (yes), the same thread into a personal account (no), the contract whose confidentiality clause restricts third-party processors (ask), the assistant pointed at a shared folder with five-year-old permissions (approved tool, unapproved exposure).

Then make the answer fast. For example, a decision tree, a prompt inside the tool, or a chat channel that answers within the hour. If clarity means booking time with legal, people will guess, and a third will not mention it.

Near Misses Are the Curriculum

In December 1974 a commercial flight struck a Virginia ridge on approach to Dulles. Six weeks earlier another airline’s crew had nearly made the same mistake on the same approach, and the warning never left that airline. NASA’s Aviation Safety Reporting System was the response: voluntary, confidential, and non-punitive, with penalties waived for honest mistakes reported within ten days. It took in 121,128 reports in 2025, about 485 every working day, and the lessons flow back into training.

Security has no equivalent. Wendy Nather and Bob Lord asked at RSAC this year why an industry obsessed with incidents learns nothing from what almost went wrong. The employee who nearly pasted payroll data into a public chatbot and caught herself is the most specific data point your program will ever get. A compliance review will not surface it. A GoTo survey this fall found 83 percent of workers fear blame or firing for an AI mistake, and 14 percent who reported one were told to keep quiet.

So build the channel. Make near-miss reporting confidential and blameless, and answer it the same day. Feed every report into next quarter’s scenarios. Measure the program on how fast people report. Completion rates measure attendance. Report speed measures whether the culture moved.

Data loss prevention and classification tagging remain the backstop for what training misses. They do not replace people who understand why the rule exists.

Aviation decided fifty years ago that the exam is where training starts. Security is overdue for its simulator.