SECURITY is meant to protect the business. But when it gets in the way too much, it can do the opposite. That challenge is becoming increasingly visible across Asia-Pacific, where organizations are embracing AI and digital transformation while employees face pressure to work faster and smarter.
For many employees, security still feels like something that gets in the way. It might be a password reset at the wrong moment, an approval process that holds up a project, or a blocked app that turns a simple task into a headache. When controls are not built around how people actually work, they can push employees toward the behavior the business is trying to stop.
Shadow AI: a symptom of workplace friction
Shadow AI is a clear example. If approved systems are difficult to access, limited in functionality or unclear, people may turn to personal devices, public AI platforms or unsanctioned applications.
In most cases, this is not malicious. Employees are trying to solve a problem, whether that means meeting a deadline, responding to a customer or keeping a project moving. But the same instinct that drives productivity can also create hidden exposure.
Our Digital Friction Report found that 40 percent of employees worldwide admit to using personal devices or apps as a workaround when work technology fails. In APAC, India reaches 66 percent, the highest in the study, while Japan sits at 22 percent, the lowest. Australia is at 38 percent.
The risk is not only unapproved tools. These behaviors also reduce visibility. Organizations cannot govern what they cannot see, and they cannot secure activity outside official systems. When security friction pushes work into unmanaged environments, it can make the business less secure, not more.
Shadow AI is therefore not simply a technology problem. It is also a sign that security, governance and employee experience are not working together. Employees may not know which tools they can use or what information can be entered into an AI platform. In some cases, sanctioned tools simply do not support the way a team needs to work.
Leaders should treat this as a signal of both a policy and design failure. It shows where employees are experiencing friction and where security may be creating gaps rather than closing them.
Poor digital experiences create business risk
That friction comes at a real cost. The research found that 80 percent of people lose time to broken IT, around 1.3 workdays a month on average worldwide. Across APAC, India loses the most time at 1.9 days a month, while Japan loses the least, at under a day.
Almost half of respondents globally say digital friction has delayed important projects or operations.
What starts as everyday frustration can become a wider business problem, slowing teams down and weakening trust in workplace technology. The challenge is to make the secure route practical, with controls that support how people work rather than interrupting it.
Security needs to enable productivity
Security should enable productivity, not compete with it. Secure processes need to be clear enough to follow and practical enough to fit into daily workflows.
Trust is central to this. Fifty-seven percent of workers do not trust their IT team to resolve issues quickly or effectively, while 47 percent fear their IT team will not adequately protect personal or work-related data. If employees do not trust official routes to meet their needs, they are more likely to find their own.
AI governance must be part of daily work
AI tools can enter an organization through different teams and for different reasons. A small productivity experiment can quickly become part of a core workflow, even if no one has clearly defined who owns the risk.
Businesses need clear responsibility for how AI is used and secured. Security teams have an essential role, but they cannot solve this alone. AI governance has to become part of the organization’s operating model, rather than a separate policy. Responsible AI use needs to become part of everyday decisions and behaviors.
Human oversight is also essential. AI can process information at speed, but it does not understand every business context or reputational consequence. People are needed to challenge AI outputs and take responsibility for decisions that carry real-world impact.
Employees also need practical guidance on approved tools and what information should never be entered into them. A policy that is difficult to find will not change behavior.
Across Asia-Pacific, governments are taking different approaches to AI. While regulations continue to evolve, businesses cannot afford to wait for every rule to be finalized before addressing how AI is used inside their organizations.
Reducing shadow AI starts with understanding the cause
Reducing shadow AI starts with understanding why employees are using unsanctioned tools. Leaders need to look closely at where approved systems fall short and where security is being introduced too late.
Too often, security is brought in after a tool or process has already been adopted. By then, controls can feel like an extra layer rather than a natural part of the workflow. A security-by-design approach brings security into the conversation earlier, so risks can be addressed before behaviors become embedded.
Employees are more likely to follow security guidance when they understand why it exists and how it supports the wider business. A policy that simply says “do not use this tool” is unlikely to be enough. People need context and confidence that the approved route will help them do their jobs effectively.
Cybersecurity conversations usually focus on outside threats. But businesses also need to look at risks building up inside their own walls, most of them coming from good intentions, not bad ones.
Shadow AI does not tell us that employees are breaking the rules. It tells us that workplace systems need to keep pace with how people work.
The businesses that succeed will not be those with the strictest rules. They will be the ones that make doing the secure thing the easiest thing to do.
Patricia Leppert is the team manager for Customer Trust & Security at TeamViewer, a global technology company that provides remote connectivity, remote access and digital workplace solutions for businesses and organizations.