By David Matalon, CEO and Founder, Venn
For years, end-user computing ran on a quiet bargain: the company owned the laptop, so the company could protect the work on it. That bargain is wearing thin. According to a spring 2026 survey, 38 percent of skilled knowledge workers in the United States now freelance, up from 28 percent a year earlier. Add offshore teams, outsourcing partners and remote employees who never received a corporate machine, and a growing share of sensitive work happens on devices IT does not own. In 2027, AI will finish breaking that bargain. Here are five changes I expect.
1. AI governance reaches past the browser to desktop apps and agents
For most employees, generative AI arrived as a chat window in a browser tab. It is fast becoming software that lives on the machine. Desktop assistants install as native applications, and coding agents read local files and run commands in the terminal. By mid 2026, 90 percent of professional developers were using AI coding agents at work at least weekly, and 68 percent were using them daily. In 2027, security teams will stop treating AI as a browser problem. The limits many teams already place on copy and paste, uploads, downloads, screenshots and printing in the browser will be extended to desktop AI apps and agents. A policy that stops at the browser will cover less and less of the real work.
2. The login becomes the control point for AI
The early question about AI at work was whether employees were using it at all. Today, the question that matters is which account they are using. In a survey of 1,000 American office workers familiar with AI tools, 80 percent said they use AI in their roles, but only 22 percent rely solely on tools their employer provides. An AI model reached through a company account, with logging and enterprise data terms, is a managed tool. The same model reached through a personal login is an exit for company data. Data from our own customers shows how wide that exit is: 62 percent of connections to browser-based AI tools from their managed workspaces were made through personal, non-corporate accounts. When customers configured their tenant restriction settings, the share dropped to 5 percent. In 2027, I expect tenant restrictions for AI services to become a routine item in security reviews.
3. AI joins the access rules companies already have
Where a company already limits sign-ins to its productivity and CRM platforms to trusted networks and known IP ranges, AI services deserve the same treatment. In 2027, I expect AI to be pulled into those existing conditional access policies rather than handled by a separate rulebook. That matters because policy is still catching up. ISACA’s 2026 poll of more than 3,400 digital trust professionals found that only 38 percent of organizations have a formal, comprehensive AI policy, and a quarter have no active policy at all. Reusing the access controls a company already trusts is a faster start than building AI rules from scratch.
4. Contractors stop getting a laptop or a virtual desktop by default
Shipping hardware to every contractor is slow and expensive. A virtual desktop keeps the worker away from the local tools that make an AI agent useful, and it brings cost and complexity of its own. Virtual desktops will keep a role for some workloads. But as agents become part of daily work, more organizations will stop defaulting to either option for contractors and personal-device users. The control boundary will move from the device to the company’s data and applications, wherever they run.
5. Saying no stops counting as a security strategy
Shadow AI is following the path of shadow IT. When useful tools are hard to reach, people find their own, and the work moves to places security teams cannot see. Blocking AI without offering an approved alternative does not remove the risk. It hides it. In 2027, the organizations that pull ahead will give their people capable, approved AI through company accounts, inside clear boundaries that protect company data. The ones still relying on a long list of banned apps are likely to end up with more shadow AI, not less.
Where this lands
The question for 2027 is not whether people will use AI on devices the company does not own. They already do. The question is whether governance follows the work there. The organizations that answer it well will govern the data, not the device.
##
ABOUT THE AUTHOR
David Matalon is the CEO and Founder of Venn, the secure remote work company. He previously co-founded OS33, the market-leading secure workspace solution for SEC and FINRA-regulated financial firms.
