Shadow IT

A team needs to share large design files and uses personal cloud accounts because the approved system is slow. Work gets done, but the business may not know where client data sits or who can access it, which is a typical shadow IT problem.

The UK National Cyber Security Centre defines shadow IT as unknown assets used for business purposes outside normal asset-management and IT processes, notes that cloud and AI tools can be involved and advises a positive, no-blame response that helps uncover the reason for the workaround. Shadow IT is not always malicious, since a new tool can be convenient and genuinely useful.

The risk is that nobody has checked data handling, access, vendor terms, retention or whether the tool can be supported after a staff member leaves. Personal accounts are a particular continuity problem, because a company may not be able to retrieve files if the employee loses access or leaves, and shared credentials can make it impossible to know who changed a record.

Unapproved software can also hide spending, as free trials may turn into subscriptions on personal or company cards and similar tools bought by several teams can duplicate costs while central procurement misses them. Start with discovery, not blame: ask teams which tasks the approved systems fail to support, and review expense records, application inventories and other lawful technical signals to identify business-use tools.

CIS Control 2 calls for an inventory of authorized software and finding unauthorized or unmanaged software, which gives security staff a way to prioritise support and remediation and should be kept current as services and users change. Classify what each tool does and the data it holds, because a note-taking app with public information needs different review from one storing medical or customer records, and high-impact data and critical workflows come first.

Offer a usable approval route, since if every request takes months staff will keep finding workarounds, whereas an expedited review for low-risk tools and a clear route for unusual needs can reduce the incentive to go around the process. Some discovered tools may be approved after assessment while others need configuration changes, data migration or safe retirement, and a blanket ban can break a useful workflow without providing a replacement.

Data migration needs care, because downloading files to a laptop before deleting a personal cloud account may create another uncontrolled copy, so plan ownership, integrity, permissions and deletion evidence as appropriate. Review vendor access and terms for tools that remain, including who owns the account, whether the company can export its data and what happens if the provider shuts down, since technology choice is also a continuity decision.

An illustrative unapproved-tools share is identified unapproved tools divided by total tools found in a defined inventory, and nine of thirty is 30%, but the denominator is uncertain when undiscovered tools remain and a low-cost unapproved tool can carry high risk if it holds critical data, so count alone cannot rank the issues. Training should explain why approval matters and how to request help, using concrete examples instead of abstract warnings, since staff may not know that a browser extension can read customer information.

Managers play a role too, as they may encourage teams to use an unsanctioned service to meet a deadline, so give them a way to escalate blocked work before staff must choose between delivery and policy. Review after changes in employment or projects, because a tool originally adopted by one person may quietly become essential to a whole team and an access and ownership check during offboarding can reveal that dependency; for an owner, shadow IT is a visibility and workflow issue, so find what people actually use, understand why, assess the risk and provide a safe route that still lets them do their work.