Understanding why staff use unapproved AI tools is key to managing the security challenges they can create.