Shadow IT

Shadow IT covers everything from a team paying for its own project-management SaaS on a personal card to an employee syncing work files to a personal cloud drive because the sanctioned file-sharing tool felt too slow or restrictive. It's rarely malicious — usually it's someone solving an immediate problem with the fastest tool available, without realizing (or caring, in the moment) that IT now has no visibility into where company data is going.

The risk isn't the tool choice itself, it's the blind spot it creates: IT can't patch, secure, back up, or apply access controls to something it doesn't know exists. A breach at an unsanctioned SaaS vendor holding company data is still the organization's breach and, depending on the data involved, still the organization's regulatory exposure — the fact that IT never approved the tool doesn't remove the liability.

SaaS made shadow IT far easier to accumulate than it used to be — signing up for a new cloud tool takes a corporate card and two minutes, no procurement process required, which is why cloud-access discovery (finding what's actually being used, not just what's on an approved-vendor list) became its own category of tooling rather than a one-time audit.