The only security risk it needs to be is to blind us from other security risks. That can be accomplished by its behavior in the network monitoring tool (many malware applications behave very similarly in a p2p fashion) or by putting us at risk of running over the amount of traffic we're licensed for in any of our tools. We're not in the business of buying licenses to support a program we explicitly disallow, so instead we're in the business of explicitly disallowing software that would put us over that license. P2P raises our risk level just by being noisy. iTunes does the same thing, and it's not P2P. It's just really, really chatty and it is also disallowed by policy. Chrome and Outlook don't put us in danger of being over our license or out of bandwidth.

Users don't understand. I get it. Information security is a young industry, and some decisions that are made might not be immediately clear. It's a negative job; if you're doing everything exactly right, users will be complaining that you're getting in their way and the bosses will be wondering why you even have a budget. If you're not doing everything exactly right, users will be complaining that they have odd charges on their credit cards and the bosses are wondering why they can't log into their email anymore.

You might not like my driving, but covering my eyes with your hands doesn't solve that problem. P2P blinds my network monitors just like your hands blind my eyes.