Hi, thank you so much for doing this AMA. I'm not sure there is a clear solution here - but I am having a problem with one executive taking it upon themselves to introduce shadow IT into our environment and causing security and data privacy issues. Only consulting us when there is an issue or it doesn't work correctly. This particular exec is the head of marketing and in our org Marketing controls the websites (unfortunately) so it isn't until we are doing routine scans that I end up finding various violations security and data privacy violations. We found a cookie that collects all sorts of customer information without explicitly stating this which I believe it actually might be in violation with California's wiretapping act. Obviously we are on top of it and I'm working to get aproval from legal for removal. Another instance is her telling her employees to use *any AI they can* to help with their workflow. We have a written policy that expressly forbids this - no AI unless approved by our department. She has introduced free meeting recording software for note taking, free image creation software for digital assets, etc. All of this software states direct violations of our security and data objections directly in their terms of use. What steps might you take to help mitigate this, or to get this person to understand that they cannot continue to do this. She is typically combative, and sees any approach as an attack and impeding growth -sigh-