shadow IT
expressionsecurityops culturegovernance & risk
Stands for: Shadow IT
Technology and services used inside an organization without the knowledge or approval of central IT.
A team signs up for a SaaS tool on a credit card because the official process is slow, and now company data lives somewhere security never vetted. Shadow IT is a symptom as much as a risk: people route around IT when sanctioned paths are too painful.
Shadow IT is technology adopted by people who needed to get work done and did not wait for approval. The file sharing account, the automation tool bought on a card, the spreadsheet that became a production system: none of it went through review, all of it is load-bearing.
The instinctive response is prohibition, and it reliably fails. Shadow IT exists because the sanctioned path was slower than the deadline, and blocking one tool moves the same work to another, usually one with worse security properties and no visibility at all. The demand does not disappear because the supply was refused.
The productive reading is diagnostic. Every instance is evidence about where official provision is too slow, too restrictive, or missing entirely, and treating discovery as intelligence rather than as an offence gets far more of it reported voluntarily. Then the response is a choice: sanction it and secure it, replace it with something equivalent, or accept the risk explicitly. All three beat pretending it is not there, which is the only option that leaves the data somewhere nobody is watching.
Also known as: shadow IT