How Branch Turned Shadow AI Into Board-Ready Visibility with Adaptive Security

“We want to educate our employees before we block them. Being able to coach people on what is and isn't approved, instead of just throwing down the hammer, was the thing that made Adaptive's AI Governance a no-brainer.”

About Branch

Branch is the AI-powered mobile linking and measurement platform behind the user journeys of more than 100,000 brands, from Reddit and Instacart to Shopify, Chipotle, and Affirm. Founded in 2014 and based in Silicon Valley, Branch helps many of the most recognized apps connect, attribute, and optimize experiences across web, app, and email, reaching billions of users worldwide.

Challenge

Rolling out enterprise AI with no view of how it was really being used

Rene Noeun leads governance, risk, and compliance at Branch, a lean function with no dedicated learning and development team behind it. When Branch rolled out an enterprise AI assistant across the company, Rene wanted something most security teams did not have: a clear view of which AI tools employees were actually using, and how, without defaulting to blanket blocks that kill all AI adoption. For a company working towards ISO 42001, going without that visibility was untenable. Tracking shadow AI and being able to show there was no data leakage were going to be table stakes. Until then, the team was working blind.

The Turning Point

Choosing to coach, not just block

Branch already trusted Adaptive for security awareness training, so when Adaptive introduced AI governance as the enterprise AI rollout was underway, the fit was as much about philosophy as features. Other shadow-IT tools simply blocked a tool and left the employee guessing. Branch wanted to build trust and coach people toward the right behavior, and Adaptive's in-the-moment coaching was built to do exactly that.

Solution

Seeing personal accounts and enterprise activity

The moment Branch turned AI governance on, the picture changed. Starting with its own security and IT team in the proof of concept and then expanding, the team saw significantly more personal-account use than anyone had expected, exactly the activity that is invisible without governance on the endpoint. Instead of reacting with bans, Branch used the data to coach, giving employees the opportunity to learn and flip to their corporate account, switch to an approved tool, or adjust their prompt.

The most telling insight was not a single number but a pattern the product made legible. Branch could see when an employee burned through their enterprise AI tokens, they quietly switched to a personal account to keep working, which told the team as much about AI demand inside the company as it did about risk.

Turning policy into a training that employees actually completed

Branch then connected its two Adaptive products in a way that shows what the combined platform can do. It took its own AI usage policy, generated a training from it inside Adaptive, and made completing that training the requirement for gaining access to the enterprise assistant. Completion reached 99.7%, a rate Branch rarely sees, helped by employees' familiarity with the Adaptive name from phishing and training. For a one-person governance function, generating a polished, policy-aligned training in the same platform was a real force multiplier.

Results

Shadow AI under management, and data the board actually uses

AI governance gave Branch three things it did not have before. It surfaced the personal-account and unsanctioned-tool use the team had been blind to, and let them coach it down rather than drive it further underground. It turned raw AI usage into board-ready intelligence, with roughly two-thirds of employees' AI activity now visible each month and broken down by tool, so a data-driven board can decide where to spend on licenses and tokens and which assistants to enable next. Most importantly, it gave Branch concrete evidence for its ISO 42001 program, showing that AI use is tracked and governed.