What is shadow IT?

Shadow IT is the set of software, cloud services and devices a team or an individual employee uses for work without IT knowing about it or having approved it. The most common case is a SaaS service signed up for with the user's own company card: a project management tool, an email marketing platform, a design tool nobody in procurement ever saw a request for. It also covers personal cloud storage accounts that end up holding work files, spreadsheets that quietly turn into an undeclared line-of-business system tracking orders or inventory, and browser extensions installed with no approval step at all. The difference from an ordinary company application is not the technology, it is visibility: nobody in IT knows it exists, so nobody protects it, patches it, or checks it when the person using it leaves the company.

See also: Shadow AI · The use of AI tools at work without approval or oversight: employees pasting company data into ChatGPT and the like.

Why it happens

It almost never starts as bad faith. It starts as a gap: a team has a problem today, the IT approval process for a new tool takes weeks of requests, security reviews and budget sign-off, and a cloud service activates with a credit card in five minutes. Whoever does it is not thinking about governance, they are thinking about getting the work delivered. The problem is that dozens of such choices, made independently across different teams, add up to a company perimeter nobody ever designed and nobody actually controls.

The concrete risks

The first is loss of control over data: documents, customer contacts or code end up on a service the company never assessed. The second is regulatory: if that service processes personal data on the company's behalf it has effectively become a vendor, and it needs a data processing agreement under the GDPR, which almost never exists for a tool signed up with a personal card. The third surfaces at offboarding: IT disables what it knows about, but a SaaS account paid for by a department with customer data inside stays active, behind one shared password nobody ever rotates. The fourth is vendor lock-in: a process informally built around an unapproved tool becomes operational dependency before anyone notices.

How it gets discovered

An audit starts from traces that already exist: the access logs of an identity provider (SSO) show which third-party apps users authorized with company credentials, expense reports surface subscriptions paid by card that never went through a purchase order, and a CASB (Cloud Access Security Broker) watches network traffic to identify the cloud services actually in use, not just the declared ones.

An enterprise example

A sales team at a mid-sized company adopts a proposal-generation tool on a company card because the official CRM cannot produce quotes in the format clients require. Over six months it fills up with price lists, contract terms and data on dozens of clients. When the person who activated it changes role, the account stays registered under her name, behind a password nobody else knows, and nobody in IT knows it exists until an automatic renewal shows up on a department invoice.

Why it matters for decision makers

Banning shadow IT only pushes usage further into the shadows. The lever that works is making the sanctioned path faster than the informal one, with a catalog of pre-approved tools and a request process that answers in days, not weeks. One growing case is when the unapproved tool is an AI assistant: there the risk shifts from a file leaving the company to data entering a prompt, a distinct phenomenon covered in the dedicated entry on shadow AI.