IT glossary
Shadow IT
Shadow IT is any software, account or device your team uses for work that the IT function does not know about, a free file-sharing tool, an unapproved app.
It is rarely dramatic. Someone needs to send a file that is too large for email, so they use a free service. A project team wants a shared board and signs up with a personal address. A department buys a small piece of software on a credit card because procurement would take six weeks and the deadline is Friday.
It appears because the sanctioned tool is worse
This is the part most commentary gets wrong, and it matters because it determines whether anything improves.
Shadow IT is not carelessness. It is people solving a real problem with the fastest available option, usually to get work done on time. Every instance of it is a small, accurate piece of feedback: the approved tool is missing, too slow, too hard to access, or nobody told them it existed.
Responding with a crackdown produces exactly one outcome, which is that the next workaround is better hidden. If you want visibility, the environment has to be one where someone can say “I’ve been using this for six months” without it becoming a disciplinary conversation.
Why it matters to you
The risks are specific rather than vague. Company data sits in an account you do not control and cannot search. When that person leaves, the data leaves with them, because the account was never yours. A client asks where their information is stored and you cannot answer with confidence. And if the service is breached, you may not hear about it at all, because you were never the customer.
What to do about it, in order
- Find out what is in use. Microsoft 365 and most firewalls can show which cloud applications people are actually reaching. Ask people too, they will usually just tell you.
- Sort it into three piles: things to adopt properly, things to replace with an approved equivalent, and things to retire.
- Fix the gap that caused it. If four teams independently found a file-transfer tool, you have a file-transfer problem, not a compliance problem.
- Make the approved route genuinely fast. A request process that takes a week guarantees the next workaround.
- Publish the list. Most people want to use the sanctioned thing; often they simply do not know what it is.
The measure of success
Not zero unsanctioned apps, that number is never real. It is whether someone tells you about a new tool in week one rather than in year two.