Ivanti’s CISO is pushing back against the instinct to ban AI tools outright, arguing instead for structured governance that keeps security teams in control without killing adoption velocity. The company’s own data is the uncomfortable starting point: 32% of employees who use generative AI at work hide that use from management entirely. Ivanti’s response is an AI Governance Council<\/a>, a cross-functional body that categorizes use cases, runs tiered review processes, and gives employees a sanctioned path to request tool approvals.<\/p>\n The 32% shadow AI figure is doing real work here. If a third of your AI-active workforce is actively concealing tool use, you don’t have a policy problem, you have a trust problem that policy alone won’t fix. The organizations most exposed are those that responded to AI’s arrival with a blanket prohibition, which reliably drives usage underground rather than eliminating it. CISOs who’ve already moved toward curated allowlists are on the right side of this; those still running hard blocks are accumulating invisible data exposure they can’t audit or quantify.<\/p>\n Ivanti’s tiered governance model, written by a vendor whose products sit inside security operations, is worth taking seriously on its structural logic even if the source has an interest in making governance sound manageable rather than genuinely difficult. The core idea, that friction reduction and security aren’t opposites, is defensible. Sanctioned AI options with a clear submission path lower the incentive for shadow adoption the same way consumer app stores lowered the incentive for sideloading. The model only breaks down if the review process becomes a bottleneck that takes weeks, at which point employees route around it anyway and you’re back to square one.<\/p>\n The talent argument buried at the end of the piece is actually the sharper long-term call. AI fluency becoming a baseline requirement for security roles means your next hiring cycle looks different from your last one, and your current team’s skill mix has a shorter shelf life than your compensation structure assumes. The leading indicator to watch isn’t whether your governance council exists; it’s whether your security team can read an AI system’s outputs critically enough to catch when it’s wrong. That’s the capability gap that compounds quietly until it doesn’t.<\/p>\nWhat this means for your business<\/h2>\n