AI and Personal Devices Outpace Security, Evade Access Controls

A new report from 1Password finds that expanding use of AI tools, SaaS apps, and personal devices by employees has outpaced traditional access controls such as SSO, MDM, and IAM.

According to an article by Anamarija Pogorelec of Help Net Security, research reveals an “access-trust gap” between what organizations believe they control and the reality of how people and their systems access company data.

This gap is evident across AI governance, SaaS usage, credential management, and endpoint security. This suggests that conventional tools and policies no longer align with modern workflows.

The study reveals that while most companies have AI policies, many employees are unaware of them or ignore them. Nearly three-quarters of workers use AI for job-related tasks, and over a quarter admit to using unapproved AI tools. “Shadow AI” use often operates outside IT oversight, raising the risk of data exposure when employees feed sensitive information into systems that aren’t vetted.

The report recommends a shift from banning AI tools to guiding and monitoring their use through structured discovery and oversight programs.

SaaS growth presents similar control challenges. Employees often adopt unauthorized cloud tools when official options prove insufficient, resulting in fragmented visibility and “SaaS sprawl.”

Many applications fall outside SSO coverage, leaving gaps in access governance and complicating the employee offboarding process. Weak credential practices persist as another critical threat. Widespread password re-use and sharing contribute to data breaches.

Companies are increasingly adopting passkeys to mitigate these risks through phishing-resistant authentication.

Legal compliance teams should be aware that the findings signal growing exposure in data access controls and user accountability. Continuous discovery, automated offboarding, and transparent AI governance will be crucial for mitigating risk.