What is shadow IT and how can you protect yourself from it?

Shadow IT is the use of systems, apps and cloud services by employees without the knowledge or approval of the IT department. It rarely happens out of bad intent. Usually a tool is faster, more familiar or easier than what IT offers. The risk is the lack of visibility: you can’t patch, monitor or protect what you don’t know about.

This article explains why shadow IT happens, when it becomes a real risk and how to get it under control step by step.

We cover shadow AI, the use of AI tools without approval, in this article.

How shadow IT starts

Shadow IT usually starts with a work problem. A team needs a quick solution, and the official request process takes too long, doesn’t fit the need or is unknown to them. Someone then signs up for a free tool with a work email address or a personal account.

Common causes:

• The request process is slow or unclear.
• Employees don’t know which tools IT already offers.
• The approved tool lacks a feature the team needs.
• Departments have their own budget and buy SaaS themselves, sometimes with their own IT engineer or an external partner.
• Employees use personal apps and devices they already know (BYOD).

During COVID-19, shadow IT grew sharply because people suddenly had to collaborate from home. That peak has passed, but the causes haven’t. Hybrid work, SaaS you can activate with a credit card and self-service marketplaces mean new tools arrive faster than IT can assess them.

Examples from practice

These are the most common:

• Personal storage and file sharing. Personal Dropbox, Google Drive or OneDrive accounts used for business files. Note that OneDrive is the approved solution at many organisations. The issue is the personal version.
• Messaging. WhatsApp or Telegram for arrangements with customers and colleagues. Business communication and personal data then sit in a channel you don’t manage or archive.
• Online converters and editors. PDF converters, image editors and URL shorteners where files are uploaded to an unknown party.
• Project management and collaboration. Trello boards, Notion workspaces or Airtable bases that a team sets up on its own.
• Meeting platforms. A second video tool because a customer or supplier uses it.
• Browser extensions. Extensions with broad permissions on every page an employee visits.
• Applications with OAuth connections. Apps where an employee uses “Sign in with Microsoft” or “Sign in with Google” and grants access to mail, calendar or files.

When does shadow IT become a risk?

Shadow IT is not dangerous by definition. An employee using a free colour picker adds little risk. It becomes a problem once sensitive data is involved or a tool gets access to your environment.

The main risks:

• No patch and vulnerability management. IT doesn’t know the application exists and can’t track outdated versions or known vulnerabilities.
• No control over access. Without SSO and an MFA policy, accounts are weaker. When an employee leaves, the account stays active and the data stays in it.
• No visibility into data. You don’t know which data is stored where, or whether personal data is processed without a data processing agreement. That is a GDPR risk.
• Broad, unnoticed permissions. An OAuth connection persists after a one-time approval. If the vendor is breached, an attacker can reach your data through that connection.
• Duplicate costs. Departments buy similar tools independently, without purchasing leverage or overview.

How do you deal with shadow IT?

Banning it rarely works. Employees move to personal devices, where you have even less visibility. Work in this order: visibility first, then policy, then enforcement.

1. Find out what is being used

You can’t assess what you don’t know. Combine technical and human sources:

• Analyse DNS, proxy and firewall logs for traffic to SaaS services.
• Review which apps have OAuth access to your environment.
• Compare invoices and expense claims for software purchased outside IT.
• Run short surveys and talk to departments. This often yields more than logs, because you also hear the reason behind the usage.

2. Assess by risk

Not every tool deserves the same attention. Classify by the data it holds and the access it has:

3. Make the request process fast and clear

If a request takes weeks, the workaround becomes the standard. Make sure employees know where to request a tool and how quickly they get an answer. Publish a list of approved tools and what they do.

4. Offer an alternative

When you reject a tool, offer a working replacement. Blocking without an alternative only moves the problem.

5. Put agreements in writing and train specifically

Policy should be short and concrete: which data may be stored where, who approves tools and what happens when someone breaks the rules. Explain why as well. A training that shows how a data breach happens through a free tool works better than a generic awareness presentation.

6. Enforce where needed

Block services you’ve assessed as high risk and for which an alternative exists. Keep monitoring, because new tools keep appearing.

Which tools help?

No single tool solves shadow IT. They complement each other:

• DNS security: shows which domains employees and devices query, including from apps you don’t know. You can block categories or specific services. It gives visibility, but says nothing about what happens inside the tool.
• Secure Web Gateway (SWG) / SASE: gives visibility into websites and apps and lets you set policy per user group, including for employees outside the office network.
• Cloud Access Security Broker (CASB): discovers SaaS usage, assesses apps for risk and enforces policy, for example access only through business accounts.
• SaaS Security Posture Management (SSPM): shows which applications have OAuth permissions in your SaaS environment and what is misconfigured.
• Data Loss Prevention (DLP): detects and blocks sensitive data going to unauthorised services.
• Endpoint Detection and Response (EDR): sees installed software and processes on endpoints. It sees less of SaaS usage in the browser, so use it as a complement.

Tools provide insight. Policy and process determine what you do with it.

Regulation

Shadow IT touches several obligations:

• GDPR: you need to know where personal data is processed and by which processors.
• NIS2: requires risk management, asset visibility and control of the supply chain. Shadow IT undermines all three.

Where do you start on Monday?

1. Pull DNS, proxy and firewall logs and make a first list of SaaS services.
2. Review the OAuth connections in Microsoft 365 or Google Workspace.
3. Talk to three departments about which tools they use and why.
4. Classify the list by risk and start with the high category.
5. Arrange an alternative and a clear request route before you block anything.