Over Half of British Employees Are Currently Using ‘Unapproved’ AI Tools at Work, KnowBe4 Research Finds

KnowBe4’s UK research finds unapproved software/AI use is a growing cyber risk: 58% of UK decision makers cite it as their top human-related cyber risk, while 55% of employees admit using unapproved tools. The report highlights the increasing challenge of managing both AI agents and human-driven behavior in the workplace, implying incremental compliance and security-control pressure for UK organizations.

Analysis

The real signal here is not rising cyber fear; it is where the remediation budget gets routed. Shadow-AI risk tends to push spend toward identity, data-loss prevention, browser control, and SaaS governance — areas where the incumbent productivity platform can bundle controls at near-zero marginal procurement friction. That creates an advantage for MSFT, and secondarily for large platform vendors that can attach policy enforcement to endpoint, identity, and network layers; it is less helpful for standalone training-first vendors, because awareness without enforcement rarely changes behavior.

The market may be overestimating how much of this becomes incremental TAM for pure-play cyber. In the first 1-3 months, most enterprises will respond with policy updates and usage restrictions, not new seats. The first measurable spend shows up only when compliance teams discover audit gaps or when a visible incident forces procurement to accelerate; absent that, the revenue impact is likely to leak into existing E5 / SSE / DLP budgets rather than expand total security dollars. That argues for a slower, more concentrated beneficiary set and a lower-quality read-through for smaller point solutions.

Contrarian view: the consensus treats “AI risk” as a new category, but the more probable outcome is category compression into existing control stacks. If approved copilots become the default, shadow-AI usage should fall without much new vendor spend; if not, then regulation and breach headlines become the catalyst, but that is a months-long path, not a days-long trade. What would falsify the platform-bundle thesis is evidence that independent vendors are taking net-new share through faster ARR growth or that Microsoft security attach is not improving despite the elevated risk narrative.

Key Decisions for Investors

• Prefer MSFT over high-multiple standalone cyber SaaS on a 3-6 month horizon; the first wave of AI-governance spend is more likely to be bundled into Microsoft than to create net-new category budgets. Invalidate if MSFT security attach / E5 expansion does not improve in the next earnings cycle.
• Do not chase the headline into training-only names; treat KnowBe4-style narratives as lower-quality spend until there is evidence of enforcement-led procurement. Watch for renewals, not survey data.
• Use PANW and CRWD as secondary beneficiaries only on earnings confirmation: buy on pullbacks if management cites higher AI-policy, identity, or data-protection attach; otherwise avoid paying up on the theme alone.
• If you want a relative-value expression, consider long MSFT / short ZS into strength over the next 1-3 months. Thesis: control-plane bundling beats point-solution monetization. Risk: ZS proves it can convert AI-governance urgency into outsized net new ARR.
• Set an alert for breach/regulatory catalysts in the UK/EU; if a prominent incident or formal guidance lands, the theme becomes actionable for 6-18 month security budgets. Without that, expect the trade to fade as a sentiment-only story.