Employees bypass tools that complicate their work. This applies to both expense reports and cybersecurity. However, companies are still unaware of these issues.
There is an unspoken rule in business. If a system makes work difficult, employees will find a way around it. This applies to CRM tools, document validations, expense report policies, and IT security is no exception. This is even where the stakes are highest. Yet many companies continue to design their products and security strategies as if this were not the case. The result is technologies that millions are invested in, secure on paper, but ignored or actively circumvented on a daily basis. This is not a minor problem. This is the central reason why security fails so often.
Security decisions are made in the wrong place
Most security strategies and solutions are designed for a specific audience, the CISO or IT director. They impress with their functionalities, their certifications, their control options. On paper, they are often excellent. But here’s the thing, the people who have to use these systems and tools every day almost never have any say in their design. And this is precisely where the problem lies, security is not limited to what is deployed. Safety is what is truly integrated into everyday work.
If a collaborator has to take five extra steps to share a file, they will find a way around them. If a collaboration solution is too restrictive, collaboration will migrate to external tools. And if key processes cannot be managed effectively, alternatives emerge outside of the intended systems.
The result is a false sense of security, a formal control that is accompanied by increasing real risk. At the same time, IT and security teams are losing visibility and oversight, making it harder to meet the internal governance requirements, regulatory obligations and security standards that customers now expect.
The real threat lies in everyday uses
When faced with security risks, businesses first think about external threats such as ransomware, phishing or targeted cyberattacks. These dangers are real, but they overshadow another vulnerability, just as important, that of the daily use of technology within the organization itself. Security breaches are not always the result of spectacular external attacks, but of seemingly innocuous decisions made in the course of everyday work. For example, when a file is shared quickly via a private link, a document is copied into an external tool, or a process is treated “as an exception” outside the systems provided for this purpose.
This behavior becomes particularly risky in business-critical processes, such as validations or contract signings. When documents circulate by email, in the form of locally stored PDFs, or via unofficial tools, blind spots appear, without clear traceability, without centralized control, without integrated security mechanisms.
These actions are rarely malicious, they generally pursue a legitimate objective, that of working efficiently. This is precisely why tools that add friction fail in this arena. To pit security against productivity is to risk losing both.
When security creates friction, risk follows
The usual reflex for companies is clear: when risks increase, controls must be strengthened. No more rules. No more validation circuits, no more steps to follow. No more friction.
In the short term, this can strengthen formal security. In the long term, however, the opposite effect occurs: the gap between official processes and actual behavior widens. Collaborators develop workarounds, implement parallel processes and use tools outside of the controlled environment. “Shadow workflows” appear, and this is precisely where the greatest risks are concentrated, without transparency, without governance, without control.
This phenomenon is particularly visible today in the context of AI. But it’s nothing new. Shadow IT becomes shadow AI, and also extends to parallel processes along critical business workflows.
Security is not achieved through control, but through use
The central question today is no longer how to strengthen control over employees, but how to design secure products and workflows that people will actually use, without creating unnecessary friction. This is precisely why a fundamental change of perspective is necessary. Security should not be treated as a layer of control added at the end of the process. It must be integrated into the design of products, processes and working methods.
Concretely, this means above all one thing: ergonomics becomes a safety factor. Systems that are complex, slow, or difficult to understand almost inevitably push employees to look for simpler alternatives, even if they are less secure. It is equally important to integrate security directly into existing workflows rather than adding it as an additional step. The most effective security solution is often one that works in the background and is barely noticed by the user.
This principle increasingly applies to document-based business processes, such as validations and contract signings. Modern electronic signature and workflow management solutions integrate security directly into the signing process, through authentication, access controls and comprehensive audit trails. For employees, the process remains simple and intuitive, while organizations maintain the visibility and control needed to support their governance, compliance and accountability. Safety is therefore not seen as an additional step, but as a natural component of work.
From categorical refusal to a new growth lever
Historically, security has often been seen in businesses as an obstacle, an entity that slows down projects and minimizes risks.
In a work environment marked by the speed of decisions, the distribution of teams and the digitalization of processes, security must become an integral component of the operational infrastructure. This requires a different approach to product design. Products that position security as an additional layer, rather than integrating it from the outset into the user experience, are increasingly less likely to be adopted in fast-paced environments. When employees bypass them, organizations lose visibility and control, while risking no longer meeting the security and confidentiality standards that customers, partners and regulators increasingly demand.
The alternative is a new conception of security, no longer as a gatekeeper external to the workflow, but as a facilitator integrated directly into it. Not in the sense of less security, but security seamlessly integrated into the way people work.
The decisive competitive advantage
Over the next few years, a clear dividing line will emerge between companies. On the one hand, those who seek to minimize risks through control, and who, in doing so, slow themselves down. On the other, those that adopt technologies that integrate security into the way people work, enabling innovation without sacrificing governance. The difference will not lie in the technology itself, but in the concept we have of security. In the end, it’s not the most restrictive security architecture that will win out, but the one that fits so naturally into everyday work that no one has any reason to circumvent it.
