If the system flags too many legitimate activities, users will find ways to bypass it, which brings us back to the usability challenge.

So balancing accuracy with user experience is still the primary hurdle.

Correct. And this leads us to the concept of zero trust. In a zero trust model, you never assume that any user or device is safe, regardless of whether they're inside or outside the network. Every request is authenticated and authorized before access is granted. This minimizes the impact of shadow IT because even if an unauthorized app is used, the data within it remains protected by strict identity controls.

It seems like zero trust forces you to confront the shadow IT problem head-on rather than ignoring it.

In a zero trust world, you assume no trust. You don't connect anything together unless it is identified. So authenticated. What is it? Has a level of authorization. Is given the ability to access only what it needs to access, you know, only within the timeframe and period that it's supposed to be allowed to access that. And then that right to access goes away. And so a lot of what we do is helping customers remind them of those principles and then showing them how you can do that in your, call it your legacy world. Because, hey, no time like the present to get caught up there, but also why this is so critical in an AI world. Because if you don't do it, I think the stakes are even much higher.