Shadow IT: definition, risks and how to bring it under control

Shadow IT means software, online services and devices used for work without IT approval. It is rarely malicious: most of the time, an employee is simply trying to get the job done faster than the official tools allow. But every unknown tool is data outside the rules, an account nobody will close and a flaw nobody will patch. You do not get rid of it by decree: you detect it, understand the need and bring it under control. Its newest form, shadow AI, follows the same logic.

The term covers any IT resource used for work outside approval processes. Some common examples:

• a file-sharing or storage service opened with a personal account to exchange with a client;
• a consumer messaging app that has become a team's working channel;
• an online subscription (project management, e-signature, forms, video calls) paid by card and claimed as an expense;
• a browser extension or third-party app given access to someone's email or documents;
• a personal device (laptop, phone, USB stick) connected to the network or used for work data;
• a spreadsheet with macros that has become a business application, or a database set up by a team on its own;
• a server or cloud environment created for a test, never declared, still exposed to the internet.

The last case is a reminder that shadow IT is not only about users: the guidance from the UK National Cyber Security Centre (NCSC) speaks more broadly of “unknown assets”, including those IT itself has lost track of.

The NCSC is clear: shadow IT is rarely malicious and usually comes from employees struggling to complete a task with sanctioned tools or processes. The causes it lists are found everywhere:

• not enough storage space;
• no way to share data with a third party (client, partner, supplier);
• no access to the services needed for the job;
• slow or cumbersome requests for a new tool;
• applications locked down “for the sake of security” to the point of frustrating users, and a weak security culture in which nobody reports their workarounds.

Add how easy it is: most online services can be opened in minutes with an email address and a card, without going through procurement or IT.

Security

• Data leaks: data handed to an unapproved service escapes your sharing, encryption and retention rules.
• Uncontrolled accounts: no single sign-on, no enforced multi-factor authentication and, above all, no closure when the employee leaves and keeps access from home.
• Ignored vulnerabilities: an unknown tool is not updated, not monitored and not covered by patch management.
• Continuity: data living in an individual account disappears with it, and the tool is in no recovery plan.

Compliance

• GDPR: as soon as it processes personal data, the provider becomes a processor that must offer sufficient guarantees and be bound by a contract (Article 28). The processing must be in the record of processing activities (Article 30), and any transfer outside the European Union must be covered (Articles 44 onwards). None of this exists for a tool nobody has declared.
• NIS 2: Article 21 expects entities to manage supply chain security and asset management. In France, listing information systems is the first objective of ANSSI's ReCyF framework.
• DORA: financial entities must identify their ICT assets (Article 8) and keep a register of information on all contractual arrangements for ICT services provided by third parties (Article 28). A subscription opened outside procurement is bound to be missing from it.
• Sovereignty: a tool chosen without assessment may store sensitive data with a provider subject to foreign law; see our article on digital sovereignty.

No single source is enough. Organisations usually cross-check:

• network logs (proxy, DNS, firewall), which show the online services actually reached from the network and endpoints; cloud discovery tools automate this analysis;
• purchases and expense claims, where subscriptions paid by card show up;
• device management and network scans: the NCSC recommends pairing the asset inventory with these tools, and treating any device that connects to the network without belonging to the organisation as shadow IT;
• the collaboration suite: third-party apps users have given access to their email or documents;
• the teams themselves: a simple, no-blame survey of the tools they use and why. It is often the richest source.

The findings feed an application inventory linked to your information system map: who uses the tool, for which data, since when, under which contract.

1. Inventory the tools you find and assign each to a business owner.
2. Sort by risk: what data does the tool handle, and how serious would its leak or loss be? The CIAP criteria help classify it, and sensitive cases call for a risk analysis.
3. Decide tool by tool: allow as is what touches no sensitive data; bring under control what is useful but exposed (contract, supplier assessment, configuration, accounts tied to single sign-on); replace with the approved tool where one exists; ban what is dangerous, and explain why.
4. Open a fast route for new needs. The NCSC recommends quick, controlled routes to obtain a service outside the catalogue, and processes to bring an unsanctioned service under control, for example by migrating its data to a supported platform. A supplier assessment proportionate to the stakes, based on a supplier security questionnaire, fits into your third-party risk management.
5. Set the rule and explain it: the acceptable use policy says what may be installed or opened, and awareness training explains why.
6. Equip without locking everything down: single sign-on for approved services, blocking of the riskiest categories, network access control based on certificates issued to devices (which the NCSC considers the most effective), and device health checks, in line with zero trust.

One condition runs through all six steps: do not punish. As the NCSC stresses, if you blame or sanction staff, their colleagues will be reluctant to report their own practices, and shadow IT will go back into hiding.

Generative AI tools have given the phenomenon a new scale: they are free or nearly so, run in a browser and deliver immediate value. Shadow AI adds two specific risks: data typed into prompts, which the provider may keep, and agents acting with the user's permissions on their email or documents. In its publication on the hidden risks of shadow AI, the NCSC takes the same line as for shadow IT: aim to reduce the risk rather than pretend to eliminate it.

The approach is the same, with one regulatory point: a deployer under the AI Act needs to know which AI systems it uses to meet its obligations, as our article on deployer obligations explains.