Shadow AI Is a Permission Problem, Not a Tool Problem

Episode Summary

Most enterprises did not decide to adopt AI. It happened to them, one Copilot license at a time. Bob Mitton, co-founder of Expera Consulting and the founding member of VMware’s marketing AI council, has a diagnostic that cuts through the confusion: ask employees how many of them use AI, then ask IT how many use the company tool. At one healthcare client the answers were 80 percent and 10 percent. His argument is that the gap is not a tool problem or a training problem but a permission problem, and that the fix is intentionality, saying plainly what people are expected to do and enabling them to do it before measuring whether they did.

Key takeaways

  • The clearest test of whether adoption is working: survey employees on AI use, then ask IT how many use the company tool. At one healthcare client staff reported 75 to 80 percent while IT measured 10 percent. The tool was fine. The difference was permission, and the rest was shadow AI

  • Measure business impact, not activity. Not logins or prompts run, but whether persona development got faster, whether more A/B testing happened, whether sales call prep dropped from two days to an hour

  • You cannot measure what you do not enable. Raising the expectation without upgrading the enablement function produces a KPI nobody can hit

  • Adoption usually starts at the mid-manager level, with someone solving one problem and telling colleagues. That is how VMware’s AI council began. The executive job is air cover and sponsorship, not dictating by fiat

  • Guardrails not gates. Enablement goes past the half-day prompt-writing class: prompt-a-thons judged Shark Tank style, prompt of the day, leaderboards, office hours for the reluctant

  • A Wharton study puts intentional adoption at roughly 40 percent, up from the tens. That still leaves 60 to 70 percent of enterprises without a strategy, including Fortune 100 technology companies

About Bob Mitton

Bob Mitton is co-founder and Managing Partner of Expera Consulting, which helps enterprises move from scattered AI experiments to governed, measurable programs. He was the founding member of VMware’s award-winning marketing AI council, a model he has since rebuilt for other organizations, and his clients range from Fortune 100 companies such as Home Depot to industry bodies like the American Marketing Association and venture studios including Mucker Capital. His background spans the full marketing spectrum, from market analysis to go-to-market strategy to executive communication, and his work centers on translating generative AI into frameworks, tools and workflows that teams actually use.

 

In this episode

00:42 Welcome and guest introduction
02:54 What ethical and intentional adoption actually means
02:59 Augment and amplify, not replace
03:35 Investing in skills rather than tools
04:01 Optimization is 10 percent thinking, innovation is 10X
04:31 How a CEO should measure whether adoption is working
04:52 Why logins and prompt counts are the wrong metric
05:23 Measuring impact instead: A/B tests, focus groups, sales call prep
05:47 Measuring whether the adoption itself is responsible
06:13 Assessed skill level as a measure of elevating a team
06:40 KPIs that hold the human and the agent together
07:29 Throwing spaghetti at the wall
07:43 Copilot licenses for everybody, and nobody using them
08:26 The healthcare client: 80 percent of staff, 10 percent of the tool
08:56 Permission structure, not tool quality
09:21 Where shadow AI comes from
09:43 Expectations showing up in annual reviews
10:01 You cannot measure what you do not enable
10:49 Nobody’s to-do list ever gets empty
11:09 Innovators, the people to elevate, and the laggards
11:58 A five-step plan for starting
12:15 Finding the hand raisers
12:35 Why it starts with mid-managers
13:04 How the VMware AI council became a company framework
13:25 Air cover, permission and sponsorship
13:40 The pattern on the AI Realized Summit panel
14:38 Why you cannot appoint this by fiat
14:58 Legal and IT on the council from day one
15:41 Sheila Jordan at Honeywell, policies before rollout
16:26 Guardrails not gates
16:31 Prompt-a-thons and Shark Tank judging
17:10 Prompt of the day, prompt of the week, office hours
17:48 What if the supply chain were a dating app
18:44 Thumbprint, the five-day sprint
19:29 A condensed version of a three-month engagement
19:58 What has changed in enterprise adoption in a year
20:18 The Wharton numbers, and the 60 to 70 percent without a strategy
21:26 Where AI transforms the enterprise next
21:42 Why laying off your knowledge base is shortsighted
22:06 Nobody measures the ROI on the internet
22:29 The new roles that did not exist before
22:53 Guidance for executives early in adoption
23:00 Pick your most annoying time-consuming task
23:45 Resources
24:29 The one thing to remember
25:06 Leadership: the defining edge
25:45 Not a marketing project, not an IT project
26:15 Wrap-up

In Bob’s words

“We turned on Copilot licenses for everybody and nobody’s using it. But there’s an intentionality of how are you using AI within your company.”

— Bob Mitton   (07:43)

“The quality of the tool is not bad, so I’m not gonna say it’s that. But it’s the permission structure. Otherwise, they were doing it on their own and you had shadow AI.”

— Bob Mitton   (08:56)

“You cannot measure what you do not enable.”

— Bob Mitton   (10:01)

“Nobody measures the ROI on the internet anymore. You don’t have an internet strategy. It’s just there. It’s baseline. And I think that AI is going to be that.”

— Bob Mitton   (22:06)

“You only need one small win to start a movement.”

— Bob Mitton   (24:52)

“This is not a marketing project. It’s not an IT project. This is a leadership exercise.”

— Bob Mitton   (25:45)

 

Resources

Bob Mitton and Expera Consulting

•    Bob Mitton on LinkedIn: linkedin.com/in/bobmitton

•    Expera Consulting: experaconsulting.com. AI strategy work for regulated industries, and the home of the Thumbprint sprint

What he points listeners to

•    Marketing AI Institute: marketingaiinstitute.com. Paul Roetzer’s organization, and the source of the optimization versus innovation line he quotes

•    The Artificial Intelligence Show: marketingaiinstitute.com. Paul Roetzer’s podcast, named on air

•    Christopher Penn: trustinsights.ai. Named on air as a podcast he follows. He is also the guest on episode 41

•    Ethan Mollick: oneusefulthing.org. The Wharton professor he calls a phenomenal writer on adoption and new tools

Frameworks and ideas discussed

•    Thumbprint: Expera’s five-day sprint: goals on Monday, data on Tuesday, narrative on Wednesday, then testing for clarity and credibility, then turning it into a system. A condensed version of a three to four month change management engagement

•    Permission structure: His term for stating plainly what employees are expected to do with AI, and what they are not. The absence of one is what produces shadow AI

•    Guardrails not gates: Stay in the lanes and you can go fast

•    Prompt-a-thons: Teams build a use case and present it Shark Tank style, with the winning tools published across the company

•    VMware marketing AI council: The cross-functional group he founded, with legal and IT involved from the beginning alongside marketing, operations, procurement and sales

People and events named on air

•    Sheila Jordan, Honeywell: Chief Digital Technology Officer. His example of the top-down mirror image: employee, adoption, governance and compliance policies written with legal before any rollout

•    Mandy Elliott, Red Hat, and Sarah Rich, CarGurus: The AI Realized Summit organization and management panel. Both fit the grassroots pattern he describes, and both have since been promoted

Related AI Realized episodes and events

•    Agentic AI and Revenue Work: What Actually Pays Off: Christopher Penn of Trust Insights, whose podcast Bob recommends on air, on measurement and proving lift.

•    AI Governance as Code: From PDF Policies to Pipelines: Ken Johnston and Bob Rapp on making the intent enforceable instead of aspirational.

•    Cognitive Capital: The Advantage Nobody Is Protecting: John Sviokla of GAI Insights on why the knowledge base you are tempted to cut is the asset.

 

Frequently Asked Questions

 
 
 
 
 
 
 
 
 
 
 
Previous
Previous

Threat Intelligence Is a Board Question, Not an IT One

Next
Next

More Podcast Episodes