TL;DR

• Your people are already using GenAI. Microsoft research found 71% of UK employees have used unapproved consumer AI tools at work, and the NCSC’s briefing on shadow AI.says plainly that you cannot manage what you do not know.
• Blanket blocking tends to push usage underground. The NCSC’s own advice is to understand why staff use these tools, provide secure alternatives, and set policies that reflect the real world.
• Join ITogether and Check Point on Thursday 26 November, 11am to 4pm, at the Land Rover Experience, Coniston Cold, near Skipton: a free, peer-led roundtable for up to 12 security leaders on securing workforce AI, lunch included, followed by off-road driving.

Event at a Glance

Date and time	Thursday 26 November, 11am to 4pm
Venue	Land Rover Experience, Coniston Cold, BD23 4EB* *new venue, on the A65 about 6.5 miles outside Skipton
Hosts	ITogether and Check Point
Format	Peer-led roundtable on securing workforce AI use, lunch, then an off-road Land Rover course with expert instructors
Who should attend	CISOs, CIOs, CITOs, heads of security and IT or risk leaders from organisations of 50+ employees, any sector
Cost and places	Free, lunch included; limited to 12 places

👉 Registration is via Eventbrite 👈

The Visibility Gap Is Already Here

ChatGPT, Gemini, Copilot and Claude are part of everyday work, approved or not. A St. Louis Fed working paper found generative AI adoption has been faster overall than the PC or the internet at the same stage of rollout, and the data shows it:

Source	Finding
Microsoft UK research (2025)	71% of UK employees have used unapproved consumer AI tools at work, with more than half doing so every week
NCSC briefing on shadow AI (September 2026)	Warns of data exposure, loss of visibility and control, and new attack opportunities when staff use unapproved AI services
Gartner, as reported by IT Pro	Forecasts that around 40% of enterprises will face shadow AI-related breaches by 2030

The risk is practical: customer data, financials and source code can end up in third-party tools, with real GDPR implications, and many organisations have no consistent view of which tools are in use. Vendor surveys vary widely on exact percentages, so treat any single figure as directional and check the sample behind it.

Why Blanket Blocking Backfires

The instinct to ban is understandable. The NCSC’s guidance points the other way: where policies cannot meet business needs, employees adopt unapproved services anyway, and the risks become harder to see. As the NCSC puts it, “You cannot manage what you do not know.”

• Understand why people use these tools before deciding what to restrict.
• Provide approved alternatives that are as easy to use as the consumer ones.
• Write policies that reflect the real world, aiming to reduce risk rather than assume it can be eliminated.
• Keep communication open, so staff will tell you what they are using.

What Good Visibility and Control Look Like

Check Point describes its Workforce AI Security approach in four stages. It is a useful structure whichever product you use:

Stage	The question it answers	What good looks like
Discover	Which AI tools and agents are in use?	A live inventory covering web apps, browser extensions, SaaS integrations, desktop agents and developer tools
Assess	Which of them are risky?	Risk scoring by tool and by session, not a single approved list
Govern	What are people allowed to do?	Policies per application, user or action: allow, warn, guide or block
Protect	What is leaving the building?	Real-time controls on sensitive data in prompts, such as data loss prevention

What We’re Seeing in Practice

What we hear most often from security leaders on this topic:

• Leaders know staff are using GenAI but cannot say which tools, how often, or with what data.
• Policies exist on paper, but nobody has tested whether people follow them or whether they push usage onto personal accounts.
• The hardest part is rarely the technology. It is setting controls without becoming the team that says no.

What We’ll Cover at the Roundtable

• Where your people really use GenAI today, including shadow AI.
• What is genuinely at risk: data leakage, IP and compliance exposure.
• Why blanket blocking tends to push usage underground.
• Governance and acceptable use policies that people actually follow.
• What good visibility and control look like in practice.

You will leave with a clearer picture of workforce AI risk in your own organisation, peer perspectives from security leaders facing the same questions, and practical quick wins you can act on straight away.

Land Rover Experience

After lunch, the group moves to a dedicated off-road Land Rover course with expert instructors. It is an informal setting with plenty of time to network, which is often where the most useful peer conversations happen. The Land Rover Experience has moved from Broughton Hall to Coniston Cold, on the A65: turn into Coniston Hotel & Spa, drive past it, and the Land Rover Experience is on the right [[what3words: dreaming.hillside.formation]]

ITogether’s Independent Verdict

Workforce AI is a visibility problem before it is a blocking problem. You cannot write a sensible acceptable use policy for tools you cannot see, and the NCSC’s advice is clear that prohibition alone drives risk out of sight.

The most useful first step for most organisations between 50 and 5,000 staff is an honest picture of current use, followed by approved alternatives and proportionate controls. As a UK Check Point partner, ITogether can help with that, and the same questions apply to New Zealand and European organisations, where our Check Point expertise is also available. A candid conversation with peers is a good place to start.

👉 Would you like one join us on 26 November?

FAQs

Who Should Attend the Securing Workforce AI Roundtable?

Heads of security and IT or risk leaders from organisations with 50 or more employees managing complex security infrastructures, across any sector.

How Much Does It Cost?

Nothing. The event is free of charge and lunch is included. Places are strictly limited to 12 so the conversation stays open and peer-led.

What Is Shadow AI?

Shadow AI means employees using AI tools their organisation has not approved or does not know about. The risks include data leakage, loss of intellectual property and regulatory exposure, which is why visibility is the first step.

Where Is the new venue?

At the Land Rover Experience, Coniston Cold, BD23 4EB, on the A65 roughly 6.5 miles outside Skipton. This is a new venue; the event has moved from Broughton Hall, see new directions below….

📞 UK +44 (0) 113 341 0123

📞 NZ +64 (0)9 802 2444

📧 hello@itogether.com