How Farnsworth Group Used Browser Defense to Draw a Safer Blueprint for Shadow AI—Without Building More Walls

Designing Security Around How People Work

Farnsworth Group is an employee-owned architecture, engineering and integrated design firm with approximately 700 employees across the United States. Its teams collaborate widely while handling valuable client information and intellectual property.

Justin Kingston oversees that environment as CIO while also performing the functions of CISO and Chief Compliance Officer. With a lean team and a wide remit, his collaborative security strategy must reduce risk without becoming another wall employees work around.

“We don’t want security to be punitive. We want people to come to us, and we want the technology we give them to provide direction rather than become a wall. We don’t want to stop progress; we want to help people stay safe.”

— Justin Kingston, Chief Information Officer, Farnsworth Group

A Stronger Human Layer Laid the Foundation

Farnsworth Group began modernizing its security stack in 2020. Its original awareness platform checked a box but did not change performance: simulation failure began around 35% and never fell below 30% during four years of use.

Kingston moved to Hoxhunt in search of a more human approach grounded in behavioral science, gamification and positive reinforcement. In the first week, the failure rate fell to approximately 3.5%. It has remained between 3% and 4%, while the organization’s Hoxhunt success rate—the percentage of simulations employees correctly report—has reached 75%.

Employees now request more training to earn stars and climb the leaderboard. That engagement created a foundation for extending the program into the browser.

“The first week we switched to Hoxhunt, our failure rate went from about 35% to 3.5%, and it has stayed between 3% and 4%. On a statistics basis, that has been an enormous win for us.”

— Justin Kingston

Replacing the DNS Sledgehammer With a Browser Blueprint

Generative AI created a new visibility gap. Farnsworth needed to prevent work product from entering free accounts or services that train on prompts, but DNS filtering could not show whether a specific account, application or activity was approved. Broad blocking was impractical as AI became embedded in legitimate services. Browser Defense provided context at the point where employees work.

It also exposed risks beyond shadow AI. Thirty-one percent of observed Chrome users were at least two major versions behind, compared with 5% of Edge users. That provided faster evidence for patch management, compliance discussions and browser standardization.

Browser Defense also surfaced a compromised third-party WordPress site presenting a fake Cloudflare CAPTCHA consistent with ClickFix—an active browser-layer threat delivered through a site employees could reasonably trust.

“DNS filtering alone was going to be a sledgehammer for a situation that needed a scalpel. We needed more granular visibility without breaking legitimate services or putting up hard walls.”

— Justin Kingston

Shadow AI Came Into Focus

Kingston analyzed 90 days of Browser Defense exports covering 8,164 nudge events across 68 AI-related domains and at least 208 individual users. Because 35% lacked user attribution, that reach is likely a floor.

The data also separated widespread adoption from concentrated risk. ChatGPT accounted for 66.5% of events, followed by the Gemini and Google AI family at 23.1%. Yet the top 10 users generated 43% of attributable activity, while 112 employees generated five or fewer events.

Instead of restricting everyone, Farnsworth can identify power users, understand their needs and provide an approved license, build an internal agent or steer them toward a sanctioned service. Importantly, he can go beyond the “what” of a security behavior alert and find out the “why.” The resulting dialogue and insights can yield new processes or permissions that prevent future security issues and support greater productivity.

“This information is gold to me. It gives us the chance to ask whether someone needs an approved license, whether we need to build an agent, or whether there is a capability gap we should accommodate. This is what I was looking for when we signed up.”

— Justin Kingston

Bypasses Revealed Workflow Gaps, Not Defiance

For consumer OneDrive, Farnsworth deployed a bypassable block that directs employees toward the corporate service while allowing them to proceed when they provide a reason. The policy recorded 284 blocks and 40 bypasses among 12 users.

The explanations turned a control into business intelligence. Some employees were retrieving past-project materials from personal accounts, exposing a potential intellectual-property concern. Others received external files through personal OneDrive because no obvious sanctioned route existed.

Farnsworth can now reinforce data-handling expectations, create a secure external-transfer process and talk directly with the small group encountering the policy most often.

“The data lets me sit down with someone and say, ‘Here is the policy, and here is what you are doing. Tell me what the gap is and what we can improve so you can use the sanctioned product.’”

— Justin Kingston

From Browser Signals to an AI Governance Roadmap

The first 90 days have not yet shown a material decline in AI activity following nudges. During complete weeks, attributable nudges remained between approximately 5.5 and 6.9 per active user. For now, the signals are most valuable as telemetry and guidance—not proof that behavior has already changed.

That evidence is shaping what comes next. Kingston is finalizing an updated AI policy and internal AI-adoption webinar series. Farnsworth can then introduce stronger controls gradually, supported by clearer standards and approved alternatives.

Browser Defense has given Farnsworth something it lacked before: evidence of where browser risk occurs, who encounters it and why. That creates a blueprint for moving from broad restrictions to targeted interventions that make secure behavior easier.

“The human-risk perspective is something we have been trying to capture. This information is going to be huge in helping us connect who is doing what, where, and then add a little more guidance for the people who need it.”

— Justin Kingston

‍