Zero Trust for Employees: Every Workaround Is a Blind Spot

Key Takeaways

• Zero trust for employees works when the secure way to work is also the easiest, because workarounds move work where verification can't see.
• Most zero trust frameworks center on verifying access, while employee risk often lives in what happens inside the session afterward.
• Applying least privilege to actions like copy, paste, upload, download, and print lets employees keep their tools while sensitive data stays inside policy.
• A telling metric for any employee zero trust program is the workaround rate: how often people leave the sanctioned path to finish their work.

Most employee workarounds start as a reasonable shortcut

A sales lead has a renewal deck due at nine, and the VPN won't connect from the hotel Wi-Fi. By the time it gives up, the deck is sitting in her personal inbox and she's finishing it on a home laptop. Nobody involved would call it an attack, and she certainly wouldn't.

Most organizations recognize some version of this scene, and the research suggests it's common. In a 2022 Gartner survey of 1310 employees, 69% said they'd bypassed their organization's cybersecurity guidance in the prior 12 months. Asked about the future, 74% said they'd bypass guidance if it helped them or their team meet a business objective.

Gartner's Paul Furtado put it plainly, describing friction "that slows down employees and leads to insecure behavior" as "a significant driver of insider risk." Workarounds rarely begin with malice; they begin with a deadline, a blocked action, and a person who still has to deliver.

The same pattern shows up in the technology people choose. In 2023, Gartner predicted that by 2027, 75% of employees would acquire, modify, or create technology outside IT's visibility, up from 41% in 2022. It was a forecast rather than a measurement, but the year it named is now only months away.

Generative AI has become the newest detour, and it's an easy one to take. In a global study from KPMG and the University of Melbourne, 48% of employees self-reported uploading company information into public AI tools, some only rarely. Most said they use free public AI tools rather than the ones their employer provides.

Remote and hybrid workers in a qualitative study presented at USENIX SOUPS 2024 told the same story with more texture. Some described doing work on personal devices to escape restrictions, and others emailed documents to personal accounts to get around print limits.

None of this means the original controls were a mistake. VPNs and locked-down managed devices solved the access problem of their era, when work lived on the corporate network and the device held the data. Today work lives in SaaS tabs and AI chat windows, so those same controls can turn a two-minute task into a detour.

None of these employees think they're creating a security incident. They think they're getting work done, and once the work moves somewhere verification can't see, the program has no record of it. That's why zero trust for employees has to be judged by what people route around, not only by what the policy says.

Zero trust pillars verify the door, but employees work in the room

Most security teams can hand an auditor a clean report on MFA coverage and device compliance, and that report reflects real, hard-won work. What it usually can't show is what happened after the employee logged in and opened the app.

The standards themselves already point past the login screen and into the session. NIST SP 800-207 says access to enterprise resources is granted "on a per-session basis," using dynamic policy that may include behavioral and environmental attributes. It also describes continual monitoring, with possible reauthentication, "throughout user transactions."

NIST is equally candid about what heavy-handed verification costs the people living with it. It notes repeatedly prompting people for reauthentication when their behavior matches their role "can lead to usability issues." It also names security fatigue, where so many policies and challenges pile up that productivity starts to suffer.

The CISA Zero Trust Maturity Model v2.0 organizes the work into five pillars. Read from an employee's seat, each pillar answers a plain question about someone named Priya:

• Identity asks, "Is this really Priya?"
• Devices asks, "Is her laptop known and healthy?"
• Networks asks, "How is her traffic reaching the resource?"
• Applications and Workloads asks, "Which apps should she be able to open?"
• Data asks, "What can she do with the information on her screen?"

CISA adds three cross-cutting capabilities across all five pillars: Visibility and Analytics, Automation and Orchestration, and Governance. The DoD Zero Trust Strategy organizes the same idea into seven pillars, promoting visibility and analytics, plus automation and orchestration, to full pillars.

In the workforce programs we see, the Data pillar is where in-session behavior lives, and it's often the least mature part. That gap can persist even when identity and device controls are strong.

Many implementations invest heavily in the access decision, which made sense because access was the first problem to solve. What an employee copies, pastes, uploads, or prints inside an approved app often goes unseen, and that's often where workarounds begin. If the risk lives in the session, the controls and the experience have to live there too.

Make the sanctioned path the easiest path to get work done

You don't solve the workaround problem by adding more locks to a door people already avoid. You solve it by making the approved route faster than the detour, so leaving it stops making sense to the person on deadline.

Start by moving verification from interruptive prompts to context. Identity, device posture, location, and behavior can be evaluated continuously in the background, consistent with the dynamic policy NIST SP 800-207 describes. Your employees see a prompt only when something about the risk changes, such as a new device or an unusual bulk download.

Then put least privilege on actions, not just on applications. Allowing the CRM is the easy part, and the harder question is what can leave it. Action-level controls answer that question without taking the tool away:

• Copy and paste between apps follows data rules, so customer records stay out of personal note-taking tools.
• Uploads to personal storage are blocked or redirected, so files stay in the corporate tenant.
• Downloads to unmanaged devices are restricted, so sensitive files don't persist on hardware IT doesn't control.
• Printing and screenshots follow the data's sensitivity, so confidential pages don't leave as images or paper.
• Pastes into AI prompts are checked for sensitive data, so people can use approved AI tools without exposing customer details.

Many teams find this next part counterintuitive: blocking an app outright is usually the most expensive control you can deploy. It creates demand for a workaround you won't see, while allowing the app with guardrails keeps the work, and the data, inside your view.

With AI, the better answer is to say yes to AI with guardrails: approved tools, sensitive data redacted from prompts, and usage logged for review. Telling people no rarely stops the work; it just moves it somewhere quieter, like a personal phone. The KPMG and University of Melbourne authors reached a similar conclusion, suggesting outright bans may be ineffective.

Where these controls live determines what they can see. Controls built into the browser, where the page renders, see the full session: the field being typed into, the clipboard, the file, and the prompt. Extensions add policy to an existing browser and reach users quickly, though extension-only approaches work within the host browser's visibility.

Network and proxy controls see traffic, which remains valuable, but they don't see what happens on the page once it loads. That's why the layers work best together, with the session layer filling the gap the others weren't positioned to cover.

Island's Enterprise Browser embeds these controls natively, so employees get a familiar Chromium-based browser while security runs quietly in the background. It's built in, not bolted on, giving your existing zero trust program a view inside the session without ripping out what you've built. Island Enterprise AI extends the same policy to AI tools, so saying yes to AI doesn't mean losing sight of the data.

Contractors and personal devices are where zero trust for employees proves itself

A contractor starts Monday, and the laptop arrives next Thursday. In between, there's real pressure to share a login or send files to a personal email address just so the project can start on time.

The frameworks expect this population rather than treating it as an exception. NIST SP 800-207 anticipates nonenterprise-owned devices, contracted service providers, and BYOD policies as part of the environment. CISA's maturity model acknowledges organizations with BYOD policies will likely have "fewer options to maintain visibility and control" of those devices.

Shipping managed laptops and standing up VDI were the right answers when the only way to control work was to control the whole device. They fit an era when applications ran on the corporate network and data lived on the endpoint. Today much of that work happens in web and SaaS apps, so control can attach to the session instead of the hardware.

In practice, the model for contractors and personal devices has three parts. Scope access to the specific apps a contractor needs, enforce action-level controls on whatever device they're using, and keep corporate data from persisting locally. Offboarding then becomes revoking a session rather than chasing a laptop through a courier's tracking page.

The same approach covers employees on personal devices, like a nurse checking a schedule from home or an executive approving a contract on a tablet. Zero trust for employees gets real when it works for people IT doesn't issue hardware to, where the device-centric model has the least reach.

Contractors also tend to be the first group to reveal whether controls are usable. They have the least patience for friction and the most alternatives, which makes them some of the most honest usability testers around. If contractors are routing around the program, employees probably aren't far behind.

Measure the workaround rate, not just policy coverage

Most zero trust dashboards report what's enforced, and very few report what employees did instead. Coverage numbers look reassuring, yet they can't distinguish a policy people follow from one they've quietly learned to avoid.

A practical way to manage zero trust for employees is to treat detours as the signal, and these five steps put it into motion:

1. Map the detours. Find where work leaves the sanctioned path: personal storage uploads, forwards to personal email, unapproved AI tools, and shared credentials.
2. Start with the embarrassing workflow. Fix one most teams know is over-controlled, such as VPN plus VDI for a single SaaS app.
3. Tie access to the lifecycle. Grant on day one, adjust on role change, and revoke on exit, all at the session level.
4. Replace blocks with guardrails. Where risk allows, swap outright blocks for warnings, redaction, or read-only access so the work stays visible.
5. Track the workaround rate. Watch blocked actions followed by another channel, access tickets, time-to-productive for new hires, and data moving to personal accounts.

Starting with the embarrassing workflow matters more than it looks. It proves the model fastest, and it earns goodwill from the people whose behavior you're asking to change. A team that sees a three-hop login chain become a single sign-in tends to give the next change the benefit of the doubt.

The workaround rate is our proposed metric rather than an industry standard, and no neutral benchmark exists yet. The DoD Zero Trust Strategy commits to performance metrics, but the frameworks covered here don't define a behavioral one. Treat your first quarter of data as a baseline rather than a grade, and watch the trend instead of the absolute number.

When the rate starts to fall, it's a sign the sanctioned path has become the easy one. A zero trust program earns its name when employees choose it because it's the fastest way to get their work done.

Your zero trust program has one more user to win over

If you're rethinking how zero trust works for your employees, we're happy to walk through what we've built. Request a demo.

FAQs

How do you manage zero trust for employees?

Verify identity and device context continuously, and apply least privilege to what people do inside apps, not only to which apps they open. Then track how often employees leave the sanctioned path, since detours are where blind spots form.

What are the pillars of zero trust?

CISA's maturity model uses five pillars (identity, devices, networks, applications and workloads, and data), and DoD's strategy uses seven. For employees, the data pillar is where everyday work and most workarounds live.

Does zero trust slow employees down?

It can when verification relies on repeated prompts and blocked apps, a usability risk NIST itself flags. Contextual, in-session controls are designed to let routine work proceed without interruption.

Is ZTNA better than a VPN for employees?

Zero trust network access (ZTNA) narrows access to specific applications instead of the whole network, which is a meaningful step forward from the VPN model. It still governs the connection, though, rather than what happens inside the session.

How does zero trust apply to contractors and BYOD?

Attach controls to the work session rather than the device, so unmanaged laptops get scoped access and action-level protections. Contractors can then start without waiting for hardware to ship.