Shadow IT: What It Is, Why It Happens, and How to Get It Under Control

What is Shadow IT?

Shadow IT is any software, hardware, cloud service, or AI tool that employees use for work without the knowledge or approval of the IT department. It is not malware or an attack — it is simply technology that bypasses the organization's normal review and approval process.

The name comes from the idea that these tools operate in the shadows: IT can't see them, can't secure them, and often doesn't know they exist until something goes wrong. Common examples include a team using a personal Dropbox to share files because the approved file-sharing tool is slow, an employee pasting sensitive data into ChatGPT to draft a report, or a developer spinning up a cloud account on a personal credit card to avoid a slow procurement process.

Shadow IT is not a new problem, but it has grown dramatically as cloud apps and generative AI tools became easy to access with just a credit card and an email address. A typical business now runs roughly 975 cloud services that IT is unaware of — against 108 that IT actually knows about.

Why employees use unauthorized tools

Shadow IT is almost always driven by practicality, not malice. When the approved tool is slow, clunky, or requires a lengthy procurement process, employees find their own solution. The research confirms this: 80% of workers admit using non-approved SaaS apps to do their jobs more effectively.

Speed. An employee needs a file-sharing solution today — not after a two-week IT review.
Usability. The approved tool often has a worse user experience than the consumer app employees already use at home.
Awareness gaps. Many employees simply don't know that using a personal Google Drive or WhatsApp group for work is a problem.
Generative AI pressure. As AI tools like ChatGPT promise massive productivity gains, employees feel pressure to use them whether or not they're approved. Roughly 70% of employees who use ChatGPT at work actively hide it from their employer.
Remote and hybrid work. Distributed teams routinely piece together their own tool stacks because centralized IT support feels distant or slow.

How widespread is Shadow IT?

The numbers are striking. According to research from Cisco, Gartner, and others:

80% of company employees use Shadow IT of some kind.
88% of organizations have experienced Shadow IT usage (Gartner, 2023).
57% of small-to-medium businesses experience high-impact Shadow IT activities.
Employees deploy an average of 1,200 unauthorized apps per company.
IT departments are aware of only one-third of SaaS applications actually running on their networks.
Shadow AI tool usage increased 156% from 2023 to 2025, and 20% of organizations have already experienced a security breach because of Shadow AI.

For small businesses without a dedicated security team, the risk is amplified. There is no one monitoring for unauthorized tools, no SaaS management platform auditing cloud usage, and no formal approval process that employees can turn to. The result is a sprawl of unmanaged apps handling sensitive business data.

Real-world examples: what can go wrong

Samsung source code leak via ChatGPT (2023)

Within a single month of Samsung semiconductor engineers being allowed to use ChatGPT, three separate incidents occurred in which engineers pasted proprietary source code, internal meeting notes, and chip yield test sequences directly into the AI tool. Because ChatGPT used conversation data to improve its models at the time, Samsung's proprietary intellectual property was potentially incorporated into a third-party system with no ability to retrieve or delete it. Samsung initially banned ChatGPT company-wide after the incidents came to light, and the case became a defining example of "Shadow AI" — the fastest-growing subset of Shadow IT.

Shadow IT in healthcare (ongoing)

In regulated industries, Shadow IT carries compliance consequences on top of security risk. A 2026 survey found that 57% of healthcare professionals had used unauthorized AI tools in their workflows. For healthcare organizations subject to HIPAA, using an unapproved app to process patient information — even briefly — can constitute a reportable breach and expose the organization to significant fines, regardless of whether data was actually stolen.

Former employee retains SaaS access (common pattern)

Shadow IT creates an invisible offboarding problem. When employees sign up for work-related tools using their personal email or a personal credit card, IT has no record of those accounts. Research shows that 31% of former employees retain access to their former employer's SaaS tools after leaving the organization. If a departing employee had signing authority for a cloud storage account holding company files, that access does not disappear when their corporate login is disabled.

Personal cloud storage as a data exfiltration path

Data exfiltration investigations regularly uncover Shadow IT as the mechanism of loss. An employee moving files into a personal Dropbox or Google Drive "for convenience" may not intend harm — but the result is company data sitting outside the company's control, unencrypted, and potentially shared with anyone. In one in three breaches, shadow data — data stored in unsanctioned locations — is involved.

Why Shadow IT is a real security risk

The core problem is loss of visibility and control. Security controls (encryption, access management, DLP, backup) only protect what IT knows about. Shadow IT systematically creates blind spots. Specific risks include:

Data exposure. Sensitive data — customer records, financial information, intellectual property — ends up in third-party systems that have not been vetted for security controls or compliance requirements.
Unpatched vulnerabilities. Unauthorized software is rarely kept up to date. An employee running an old version of a file-sharing client or an unmaintained browser extension becomes an exploitable entry point.
Weak credentials. Employees setting up personal accounts often reuse passwords or skip multi-factor authentication. If those credentials are breached, attackers gain access to company data stored in those accounts.
Compliance violations. For organizations subject to HIPAA, PCI-DSS, SOC 2, or other frameworks, unauthorized tools handling regulated data can trigger breach notifications, audits, and fines — even with no malicious intent.
Vendor risk. Every Shadow IT tool is an unvetted third-party vendor. If that vendor is breached, your data goes with it — and you had no contract, no DPA, and no breach notification requirement in place.
Increased breach cost. Data breaches involving Shadow IT average $4.2 million per incident. Shadow AI breaches add an additional $670,000 on average above standard breach costs.

How to manage Shadow IT: a practical approach for small businesses

The goal is not to eliminate Shadow IT — that is unachievable. The goal is to reduce the risk it creates by building a program that makes approved tools easy to use, gives IT visibility, and handles unauthorized tools proportionally to their risk.

Step 1 — Find out what you're dealing with

You can't manage what you can't see. Start with a basic audit:

Review DNS/firewall/proxy logs to identify cloud services employees are accessing. Most next-generation firewalls can report on application traffic.
Ask your team directly. A short anonymous survey asking "What tools do you use to get your work done?" often surfaces more Shadow IT than any technical scan.
Check your credit card and expense statements for SaaS subscriptions billed to individuals rather than the company.
Review browser extensions on managed devices — extensions are one of the most overlooked Shadow IT surfaces.

Step 2 — Establish a simple, fast approval process

Employees resort to Shadow IT because asking IT feels slow or pointless. Fix this by making the approved path easier than the shadow path:

Create a short, simple form for requesting new tools. Aim for a 48-hour initial response — not a two-week process.
Maintain a published list of approved tools so employees don't have to ask about common categories (file sharing, video conferencing, project management).
Set clear minimum criteria for approval: Does the vendor have a privacy policy? Do they offer MFA? Do they have a security contact? These baseline questions can be answered in minutes.

Step 3 — Write a clear acceptable use policy

Many employees genuinely don't know that using a personal Google Drive or texting client data is a problem. A written policy makes expectations explicit and gives you a foundation for training and enforcement.

Define what constitutes Shadow IT and give concrete examples (personal cloud storage, unapproved AI tools, personal email for work).
Clarify what data cannot leave approved systems (customer PII, financial records, health information, proprietary business data).
Explain the "why" — policies feel arbitrary until employees understand the real risk behind them.
Include a no-penalty amnesty provision for reporting existing Shadow IT. Employees won't come forward if they fear consequences.

Step 4 — Prioritize by risk, not by approval status

Not all Shadow IT is equally dangerous. An employee using Grammarly on non-sensitive documents is a different risk level than an employee pasting customer data into an AI chatbot. Prioritize your response based on:

Data sensitivity. What data is the tool touching? Personal health information, financial records, and customer PII deserve immediate attention.
Number of users. A tool used by one person is a smaller blast radius than one used by a department.
Vendor security posture. Does the vendor have SOC 2, ISO 27001, or similar? Do they offer MFA and encrypt data at rest?

Step 5 — Apply security controls to what you can't immediately eliminate

For Shadow IT you discover but can't immediately retire, apply the highest available controls:

Require multi-factor authentication (MFA) on any account used for work, even personal accounts.
Move work data out of personal accounts and into approved systems as soon as possible, then revoke access.
Use single sign-on (SSO) wherever possible — if a tool supports SSO with your identity provider, you gain centralized visibility and can de-provision access during offboarding.
Block high-risk categories at the network or DNS level (e.g., personal email, personal cloud storage on managed devices) if your risk tolerance warrants it.

Step 6 — Address AI tools specifically

Generative AI is the fastest-growing category of Shadow IT and deserves its own policy. Simply banning AI tools tends to drive usage underground rather than stop it. A more effective approach:

Designate one or two approved AI tools with appropriate data handling agreements, and make them easily accessible.
Publish explicit guidance on what data employees may and may not input into any AI tool — approved or otherwise. "Never paste customer PII, source code, financial records, or confidential business information into an AI tool" is a clear, enforceable rule.
Review the data retention and training policies of any AI tool employees use — some tools use user inputs to improve their models unless you explicitly opt out via an enterprise agreement.

Step 7 — Build offboarding into your process

Shadow IT makes offboarding incomplete by definition. Add a Shadow IT step to your employee offboarding checklist:

Ask departing employees to list all work-related tools they signed up for using personal accounts or credit cards.
Transfer ownership of those accounts to a company account or close them.
Remind departing employees in writing that company data must be removed from personal tools before their last day.

Bottom line

Shadow IT is not a sign of malicious employees — it is a sign that the approved tools or processes aren't meeting employee needs. The organizations that manage Shadow IT most effectively treat it as a service problem first and a security problem second: make legitimate tools easy to get, fast to approve, and pleasant to use — and the pull toward unauthorized alternatives shrinks.

For small businesses, a practical Shadow IT program doesn't require enterprise tooling. It requires visibility (ask and look), policy (write it down and explain the why), a fast approval path (don't make IT the bottleneck), and proportional response (focus your effort on the tools touching your most sensitive data).

The Samsung ChatGPT incident and the pattern of former employees retaining SaaS access are reminders that Shadow IT risk is real and measurable. A lightweight, consistently applied program is far better than a comprehensive policy that no one follows.