When a driving instructor sits in the passenger seat of a dual-control car, they are performing a delicate act of psychological theater.

Peter D.-S., a man who has spent thirty-one years watching nervous teenagers nearly clip the side mirrors of parked Volkswagens, once told me that the hardest part of the job isn’t teaching the three-point turn.

It is the moment you realize the student has committed to a bad decision. Because you have your own set of pedals, you can stop the car instantly, but if you do it too early, the student never learns why the mistake was a mistake. If you do it too late, you’re both in a ditch. Peter’s entire career exists in that three-second window between a student’s intent and the physical reality of the curb.

IT security, though rarely as visceral as a literal car crash, operates in a similar, albeit much longer, temporal window. Farah, an IT security officer at a mid-sized firm, currently finds herself staring at a support ticket that represents the digital equivalent of a student driver already doing seventy in a residential zone. The ticket is titled “Quick question about an app,” which is a universal corporate euphemism for “We have been using this for months and just realized we might need your permission to keep doing it.”

The Anatomy of a “Quick Question”

Attached to the ticket is a screenshot from the sales director. It shows a dashboard of a contact-sharing tool, a sleek interface designed to help the team manage their networking links and digital profiles. It is clean, efficient, and undeniably useful. However, in the top right-hand corner of the image, Farah spots the small, circular avatar of the sales director’s personal Gmail account.

This is the smoking gun. It isn’t just one person testing a tool; the screenshot accidentally reveals a sidebar with forty different active profiles. Although the sales team believes they are merely being “agile” by bypassing the official procurement queue, they have effectively moved the company’s most sensitive networking data into a suburban garage with no locks.

Farah starts a reply, deletes it, and starts again. She has a paper cut on her index finger from an envelope she opened this morning-a sharp, nagging little sting that perfectly matches the low-grade irritation of this ticket. The envelope contained a printed security policy update from the head office, an irony that is not lost on her as she stares at a team that has successfully ignored every policy in that envelope for the last quarter.

Which is also how a single, well-intentioned shortcut becomes a structural vulnerability that no amount of late-stage “questionnaire-filling” can truly fix.

The Friction Chasm

The frustration here isn’t that the sales team is malicious. They are, in fact, doing exactly what they were hired to do: move fast and build relationships. The problem is the gap. In most corporate structures, there is a yawning chasm between the moment an employee identifies a need and the moment the IT department is permitted to offer a solution.

This gap is not a vacuum; it is filled with Shadow IT. When the official route involves a six-week ticket queue, a sixteen-page risk assessment, and a networking event next Thursday where the “approved tool” will be demoed, the sales floor will always choose the three-minute signup process of a random SaaS app they found on a podcast.

Security teams are often invited into the conversation only after the commitments have already been made. By the time the sales director sends that “quick question,” the team has already printed the QR codes on their collateral, synced their calendars, and possibly even paid for a premium subscription on a personal credit card. At this point, the security officer isn’t an advisor; they are an executioner.

If Farah says no, she is the person who broke the sales team’s momentum. If she says yes, she is rubber-stamping a tool that has never been vetted for encryption standards or data sovereignty.

The Border Crossing Trap

Roughly three out of four people would rather risk a data leak than a boring Tuesday spent waiting for an admin approval. This isn’t a failure of character; it’s a failure of process design. We treat security like a border crossing where you have to stop and show your papers, rather than like the engine of the car itself.

When security is an external event that happens to a tool rather than a feature of the tool, people will always look for a way around the checkpoint.

Peter D.-S. used to say that if you’re looking at the hood of your own car, you’re already crashing. You have to look a hundred yards ahead to see the curve before it arrives. In the world of corporate networking, looking a hundred yards ahead means acknowledging that employees will find a way to share their contact information digitally.

The old way-the stack of five hundred paper cards that become obsolete the moment someone gets a promotion-is a dead medium. It is a slow, expensive, and wasteful relic. The sales team knows this, which is why they went rogue.

Because the team felt the pressure of a cold room at a conference, they reached for the nearest digital warmth. They needed a way to ensure that when they met a high-value prospect, the data exchange was seamless. They wanted a system where they could update their titles once and have it reflect everywhere. They wanted

Digital Business Cards

that actually worked in the moment of the “handshake,” whether that handshake was physical or over Zoom.

The tragedy of Farah’s current situation is that there are secure, enterprise-grade ways to do exactly what the sales team wants. There are platforms like One Good Card that offer AES-256 encryption and carry certifications from the Cyber Security Agency of Singapore (CSA).

These tools allow an administrator to lock branded templates, manage permissions centrally, and ensure that when an employee leaves the company, their digital card and the leads they gathered don’t leave with them. But because the sales team didn’t know these existed, or assumed the approval process would be a nightmare, they settled for a consumer-grade app that stores data in a jurisdiction the company can’t even name.

Becoming the “Better” Department

Which is also how a department meant to protect the company becomes the department that people hide things from.

“Instead of treating the sales director like a criminal, Farah has to treat him like a customer who found a better shop down the street.”

When Farah finally sends her reply, she doesn’t lead with the policy. She leads with a question about how many leads they’ve actually managed to pull into the CRM from this new app. She knows the answer: zero. Consumer-grade shadow tools almost never talk to the company’s actual database. They are islands of data, convenient for the individual but useless for the collective.

The goal isn’t to drag him back to the old shop; it’s to build a better one that doesn’t leak his data.

The paper cut on Farah’s finger continues to throb. It is a small reminder that the most insignificant things-a thin slip of paper, a “quick question” ticket-can cause a disproportionate amount of pain if they aren’t handled with care. She realizes that her role shouldn’t be the dual-control brake that stops the car. It should be the person teaching the driver how to handle the high-performance machine they’ve already jumped into.

When a company chooses a platform that is already certified and encrypted, they aren’t just buying a tool; they are buying their security team’s time back. They are ensuring that the next time a sales director sends a screenshot, it shows a verified company badge and a managed domain, not a personal Gmail account and a looming data breach.

Institutional friction is often mistaken for safety. We think that by making things difficult to approve, we are making them difficult to exploit. In reality, we are just making the workarounds more attractive. The most secure tool in the world is the one that people actually use because it makes their lives easier, not the one that sits in a locked cabinet because nobody can figure out the login.

Farah finishes her email. She suggests a pilot program for a managed digital card system-one that respects the sales team’s need for speed and her own need for AES-256 peace of mind. She doesn’t mention the paper cut, but she does mention that the “quick question” has a very long answer, one that starts with a better way to network and ends with a company that actually owns its own data.

As she hits send, she thinks about Peter D.-S. and his dual-control pedals. Sometimes, the best way to keep the car on the road isn’t to slam on the brakes, but to reach over and help the student find the right line through the curve. It requires a bit more trust, and a much better set of tools, but it beats the alternative of sitting in the wreckage, holding a perfectly filled-out questionnaire while the data disappears into the ether.