Shadow IT

Shadow IT is every system your organisation actually runs that IT never approved: the marketing team's analytics subscription, the manager's spreadsheet-turned-database, the AI assistant pasted with client documents. It is not a compliance footnote — it is a live map of where official tools failed, and increasingly, where your data quietly leaks.

What It Is

Shadow IT comprises technology adopted outside formal procurement and governance: SaaS subscriptions bought on departmental cards, free tools adopted by teams, unsanctioned devices, and — the defining category of the current era — employees feeding corporate data into consumer AI services. It proliferates because official channels are slower than the work: shadow tools are almost always a symptom of unmet need, not insubordination. The risks follow the data: no access control, no offboarding, no vendor assessment, no data protection terms, and often ongoing payment nobody owns.

Why It Matters to You

The governance response that works is epidemiological, not authoritarian: discover (network logs, SSO logs, expense data, browser extensions), understand why each tool was adopted, and either formalise the good ones or fix the official alternative that drove people around it. Blanket bans simply drive the practice further underground. The AI era has raised the stakes decisively — staff pasting contracts, patient details or client data into public AI tools create data-protection exposure no policy can retroactively cure, which is why AI governance now begins with knowing what AI is already in use. Every shadow tool you find is also intelligence: a requirements document your official stack failed to write.

When You'll Meet It

In security reviews, data-protection audits, and — urgently — any AI adoption initiative. The first question of AI governance is not 'what should we allow' but 'what is already happening'.