100% of organizations grant security or compliance exceptions to allow high-risk digital work to proceed; 63% grant exceptions formally and 33.5% use informal workarounds.