IT departments have spent a lot of money on security. They've hardened the castle walls but left the drawbridge open with IM. The big problem is that IM is user-deployed.