Shadow IT is hardware, software, or cloud services used inside an organisation without the knowledge or approval of the IT department.
Shadow IT is hardware, software, or cloud services used inside an organisation without the knowledge or approval of the IT department. The name fits: it works in the shadows of the official tool list - the file-sharing account someone opened to send a large file, the project board a team adopted on a free trial, the spare router under a desk. It is rarely malicious. Almost always it is someone solving a real problem faster than the official route would, on personal devices that shade into BYOD territory or on unapproved endpoints that IT has never seen.
Common examples of shadow IT
- Free SaaS sign-ups - file sharing, note-taking, design tools, messaging, project boards, registered with a work email in minutes.
- Department subscriptions - paid tools bought on a team card and expensed, never reported to IT, with nobody reading the terms.
- AI tools - assistants and transcription services where staff paste company data without anyone reviewing where that data goes.
- Personal hardware - USB drives carrying work files, personal laptops used from home, a privately bought webcam or scanner plugged in because the official one never arrived.
- Off-register equipment - kit bought from petty cash that exists physically but appears in no IT inventory, so it is never patched, insured, or recovered at offboarding.
Why shadow IT happens
Shadow IT grows in the gap between what people need and how long the official route takes. A procurement process that answers in six weeks loses to a free trial that takes ninety seconds. It also grows where the sanctioned tool is genuinely worse: people do not route around IT for fun, they route around friction. That is why shadow IT is best read as feedback - a live map of where the approved toolset is failing.
The risks
- Data nobody can retrieve or wipe - when the person leaves, the files stay in an account the company does not control.
- No safety net - shadow tools sit outside backups, MFA enforcement, and patching.
- License and contract exposure - unapproved tools mean unread terms, duplicate spend, and surprises in a software audit.
- Compliance blind spots - personal data in unknown systems is a problem under GDPR, and “we did not know it existed” is not a defence.
- Untracked devices - hardware that appears in no register cannot be secured, audited, or asked for back.
How to detect shadow IT
The unglamorous methods work best. Review expense claims and card statements for recurring small subscriptions. Check single-sign-on and DNS logs for popular SaaS domains; dedicated cloud-discovery tools exist for larger estates. Treat the periodic inventory and every offboarding as discovery moments - the leaver’s handover is where unknown accounts and devices surface. And simply ask teams what they actually use; most people will tell you, because they were never hiding it, just unblocked.
Reducing shadow IT in practice
Bans alone push usage further into the shadows. What works is making the sanctioned path faster than the workaround: a short approved-tools list, a request route that answers quickly, and a visible register so people can see what already exists before buying again. AMPthilly supports this pattern with an employee request-and-wishlist flow routed to an approver, so asking for the right tool is quicker than buying it sideways - and everything approved lands in the register with an owner and a history.
Related terms
- Endpoint - any device on the network, known or not
- MDM - device management that only covers the devices IT knows about
- BYOD - personal devices at work, shadow IT’s closest neighbour
- Hardware Asset Management - the register discipline that makes unknown kit visible
- IT Inventory - the periodic count where shadow assets get discovered