Shadow IT definition

Shadow IT is the unauthorized use of any digital service or device that is not formally approved and supported by the IT department.

Though users generally turn to shadow IT to improve the speed at which they can perform their jobs, the use of such services is unknown to the IT team and therefore not protected by the organization’s cybersecurity solutions or protocols. In the case of cloud workloads and other services used by developers, assets may contain serious vulnerabilities, such as the use of default passwords or misconfigurations. This exponentially increases the risk of data breaches, noncompliance, and other liabilities.

Shadow IT examples

Examples of shadow IT include:

• Creating cloud workloads using personal accounts or credentials
• Purchasing software as a service (SaaS) applications or other cloud services subscriptions that fall below the purchasing thresholds outlined by IT
• Using workflow or productivity apps such as Trello or Asana
• Leveraging public cloud services, such as Google Drive or Box, to store, access, or share data or other assets
• Using messaging platforms or communication applications, such as WhatsApp or Zoom, to conduct work-related communication

Why is shadow IT a growing problem?

The use of shadow IT has become increasingly prevalent in recent years because of business transformation efforts. A 2019 study from Everest Group estimates that nearly half of all IT spend “lurks in the shadows.” Notably, these figures are pre-pandemic. It is likely that a sudden influx of remote workers due to COVID-19 restrictions has further increased the use of shadow IT as workers struggle to maintain productivity in a new environment with limited resources.

The use of shadow IT is rarely malicious. Rather, it is a practice embraced by employees because their day-to-day roles require fast, flexible, and frictionless access to different tools and applications.