What should organisations do when employees keep bypassing approved IT tools?

Treat repeated bypassing as a signal that approved tools are not meeting real work needs. The right response is to investigate why employees are choosing alternatives, then close the gap with better communication, faster approvals, training, and secure substitutes that are actually usable. If the sanctioned path is slow or impractical, shadow IT will keep reappearing.

Why This Matters for Security Teams

Repeated bypassing is not just a policy issue. It is evidence that the sanctioned path is failing on usability, speed, or fit for purpose, and that gap often pushes data, credentials, and workflows into tools the organisation cannot govern. For security teams, the risk is less about the existence of shadow IT and more about where sensitive information, approval chains, and access tokens end up once employees work around the official process. NIST SP 800-53 Rev 5 Security and Privacy Controls is useful here because it frames controls as operational safeguards, not just policy statements.

Security teams often misread bypassing as defiance and respond with stricter approval gates, more monitoring, or blanket prohibition. That can reduce visibility further if staff move to personal accounts, unsanctioned SaaS, or messaging apps where logs, retention, and incident response reach are weaker. The real issue is control design: if approved tools slow legitimate work, people will route around them until the organisation either fixes the workflow or accepts unmanaged exposure. In practice, many security teams discover the true scale of bypassing only after data has already been shared outside approved systems, rather than through intentional governance.

How It Works in Practice

The most effective response is to treat bypassing as an operational signal and a governance input. Start by identifying which tools are being bypassed, who is doing it, and which tasks are driving the behaviour. That usually reveals whether the problem sits in approvals, access friction, missing features, poor integrations, or a mismatch between policy and day-to-day work.

• Review the specific workflow that employees are avoiding, not just the policy that forbids it.
• Map the bypass to the control it weakens, such as access approval, data handling, logging, or retention.
• Provide a secure substitute that is faster or easier than the unsanctioned option.
• Shorten exception handling so legitimate urgency does not become a reason to improvise.
• Use training to explain the risk in practical terms, not as a generic awareness message.

That approach aligns with security governance because it distinguishes between deliberate noncompliance and poor control design. If employees are bypassing an approved collaboration tool because sharing a file takes ten manual steps, the fix may be workflow redesign, not more policy reminders. If they are bypassing due to missing integrations, the remedy may be identity federation, better API access, or a sanctioned alternate service with the right safeguards. The right control objective is to make the secure path the easiest path for the common case while preserving review for genuine exceptions. Guidance from NIST SP 800-53 Rev 5 Security and Privacy Controls supports this kind of control tailoring, where implementation should fit the operating environment rather than rely on one-size-fits-all enforcement.

These controls tend to break down when business units rely on unmanaged consumer apps for time-critical work because security has no approved alternative that matches the same speed and convenience.

Common Variations and Edge Cases

Tighter enforcement often improves control consistency, but it also increases friction, which means organisations have to balance compliance against actual productivity. That tradeoff becomes more visible in sales, field operations, executive support, and M&A activity, where people are under pressure to move fast and may see formal tools as too slow.

There is no universal standard for handling every bypass scenario, but current guidance suggests the response should vary by risk. A low-risk convenience shortcut, such as using an unauthorised note-taking app for personal task tracking, is not the same as moving confidential client data into an unapproved file-sharing service. The first may call for education and a better sanctioned tool; the second may require containment, logging review, and stronger access controls.

Identity and access also matter here. When staff bypass approved tools because sign-in, multi-factor authentication, or entitlement approvals are cumbersome, the organisation may have created an access experience that is secure on paper but unusable in practice. NHI governance becomes relevant when employees work around controls by creating unsanctioned service accounts, shared credentials, or ad hoc automations that outlive the original need. In those cases, the issue is not just shadow IT, but unmanaged identity sprawl.

In short, the best answer is to remove the reason for bypassing where possible and constrain the risk where not. If the sanctioned process remains slower and harder than the workaround, the workaround will keep returning in slightly different form.

Related resources from NHI Mgmt Group

• Why do employees keep using shadow IT even when organisations prefer approved tools?
• How should organisations govern AI usage when employees use unapproved tools?
• How should organisations audit AI use that happens outside approved tools?
• Why do former employees still keep access after offboarding in many organisations?