The Human Firewall Has Office Hours

The report nobody wanted to read

Years ago I worked at a startup called Elastica. We sold cloud access security, and my job was running shadow-IT discovery assessments for big enterprises. We’d plug into their traffic for a couple of weeks and then sit down with the CIO and walk through what we found.

I still have some of those reports. One of them shows 185 cloud apps in use across the company. IT had sanctioned 53. That 71% of the company’s work happening somewhere nobody in security could see.

I’ll never forget the look on the CIO’s face. Not anger. Recognition. Every one of those apps was somebody trying to get their job done faster than the official process would let them.

That was shadow IT. Today we call it shadow AI. The tools changed. The people didn’t.

The 4:45pm problem

I read two pieces in CTO Magazine this week that, together, explain a lot about why that report looked the way it did.

The first was an interview with Maarten Verschuere, who leads cybersecurity research at VIVES University in Belgium. His team found that the people most likely to fall for phishing are the ones carrying the highest cognitive load. The busier your calendar, the more likely you are to just do what the email says.

The second was about chronoworking, the idea of aligning work hours with your natural energy cycle. It cites Wharton neuroscience research showing that the things we need to make good decisions, like focus, impulse control and complex reasoning, rise and fall with alertness across the day.

Put those side by side. The same analyst who spots a fake invoice at 9am clicks it at 4:45pm, after eight back-to-back calls and a sandwich eaten over the keyboard. Same person. Same training. Different firewall.

We spend millions hardening systems that run at the same performance 24 hours a day. Then we connect them to humans who don’t.

Shadow AI is a people problem wearing a tech costume

Verschuere makes a point I’ve been making on stage for a while: AI adoption is an HR challenge before it’s an IT challenge. His framework is simple. Inspire, then enable, then scale. Most companies run it backwards. They buy the licenses, announce the strategy, and wonder why usage is flat six months later.

I see it from the vendor side all the time. The platform is ready. The people aren’t. And when the sanctioned path feels slow or scary, people don’t stop working. They find their own way. That’s how you end up with 71% of your work running somewhere you can’t see, whether it’s 2015 or 2026.

The answer isn’t another blocking policy. It’s a workforce that understands the tools well enough to use the right ones, and leaders honest enough to admit they’re still figuring it out too. Verschuere says leaders have to let go of their own anxiety first. I’d add: they have to say it out loud. “I don’t know yet” from the top makes it safe for everyone else to ask.

Chronoworking sounds great. Until the patient codes.

I like the idea behind chronoworking. Let people do deep work when their brain is actually on. But I started my career in nursing, and nobody asked my circadian rhythm when to show up for a shift. Patients don’t wait for your peak hours.

Sales isn’t much different. My customers in insurance set the meeting times. So does the Microsoft field team I co-sell with. The article itself admits chronoworking doesn’t fit roles like healthcare, customer service or security operations.

So I don’t think the lesson is “let everyone pick their hours.” I think it’s smaller and more useful than that. Know when your people are depleted, and stop putting your highest-risk decisions there.

It all runs on trust

Both articles end in the same place, and so does every good team I’ve been part of. Trust.

Chronoworking only works if leaders stop measuring commitment by who’s online at 8am. AI adoption only works if people trust that the tools are there to help them, not replace them. And the human firewall only holds when people feel safe saying “I think I just clicked something I shouldn’t have” without fearing for their job.

The best leader I ever worked for didn’t need to see a green dot next to my name to know the work was getting done. He knew me. He knew what I was working toward at work and at home. That kind of trust doesn’t come from a policy or a dashboard. It comes from time, honesty and a few meals shared around a table.

If you lead people, here’s my ask. Look at your team’s calendar before you look at their security score. The gaps you find there are real vulnerabilities, and they’re the ones no tool will patch for you.

We keep looking for the next tool to close the gap. Sometimes the gap is just a tired person at the end of a long day, doing their best.

Be Human First.

Sources

• Maarten Verschuere on Why AI Adoption Will Fail Without Workforce Readiness, CTO Magazine, Sept. 28, 2026
• Could Chronoworking Be the Next Step Toward Work-Life Balance?, CTO Magazine, Sept. 26, 2026
• What’s Your Chronotype? How Brain Science Can Boost Performance, Knowledge at Wharton