The revolt does not start in the security team. It starts on a Tuesday, when a branch manager needs an answer and the new tool is slower than the app already on the phone.
People did not choose a consumer messenger because they enjoy the risk. They chose it because a decision was waiting, and the official channel was an email thread with forty people on it. If the replacement is harder, they will go back. Quietly. By Thursday.
Start where the cost is already obvious
Do not begin with a company-wide ban. Begin with the conversations that already have a price when they leak or when they cannot be found: treasury confirmations, credit approvals, a plant handover, the papers for a committee.
Those teams can tell you, in one meeting, which gestures they cannot lose. A group. A voice note. A photo of a page. A call. Messaging has to do those things on the first day, on the phones they already carry.
Put it on the directory they already trust
A second password is a reason to refuse. Sign-in should be the account your directory already issued. A lost phone should be the same problem your device team already knows how to revoke, not a new kind of ticket.
Tell people, in one sentence, what is different. The chat looks familiar. The message stays on the organisation’s servers. Forwarding and downloads follow a rule, and the rule is visible, so security does not have to nag.
Do not announce a ban and a course on the same morning
Training for a tool that feels like the old one should be short enough to be slightly embarrassing. If it takes half a day, the tool is wrong, or the trainer is teaching the administration console to people who only needed to send a note.
The administration console is a different audience. IT and security get Control Tower. Everyone else gets the conversation.
Measure one thing
Count whether the decisions have moved. Not logins. Not a launch email’s open rate. Ask the treasury desk, a month later, where a confirmation now lives. If the answer is still a personal chat, the rollout has not happened, whatever the project plan says.
When you want to see the same path on your own directory, request a demo. Bring the team that would actually refuse a clumsy tool. They are the right critics.