Common forms: SaaS contracted by a department without IT, free accounts registered with corporate email, browser extensions and plugins, automations and scripts against external APIs, cloud tenants paid on a company card, and unmanaged personal devices.
What is shadow IT?
Shadow IT is the set of applications, cloud services, devices and accounts employees use for work without the approval or knowledge of the IT department. It ranges from a free task manager registered with a corporate email to SaaS subscriptions paid on a company card, automations calling external APIs or — the newest chapter — pasting internal information into personal generative AI tools. It rarely stems from bad faith: it appears because the business moves faster than the official catalogue, and every piece expands the attack surface with nobody watching it.
Why does it matter?
Because you cannot protect what you do not know exists. Every unmanaged application runs without corporate MFA, without IAM integration, without controlled patching, logging or backup: if the vendor suffers a breach or the employee leaves, nobody knows what data was there or can revoke it. Offboarding is the classic blind spot — a former employee's account in an unknown SaaS stays alive with customer data inside. On the compliance side, shadow IT turns vendors without a contract into processors of personal data (a direct GDPR problem) and leaves ICT suppliers out of the inventory that NIS2 and DORA require you to identify and assess. Generative AI has multiplied all of it: "shadow AI" — personal chatbot accounts, plugins and browser extensions with broad permissions — moves confidential information out of the perimeter in the form of prompts, a flow traditional DLP was never designed to see.
Key points
Shadow AI, the fastest-growing vector: employees using chatbots and AI assistants with personal accounts, pasting code, contracts or customer data into prompts. The risk is not AI itself, but data leaving without control, without a contract and without any possibility of deletion.
Technical discovery: a CASB analyses proxy, firewall and DNS logs to inventory which SaaS is actually in use and how risky it is; reviewing OAuth consents in Microsoft 365 or Google Workspace uncovers third-party apps with standing access to mail and files.
Data discovery: DSPM complements the CASB by answering the question that matters — what sensitive data sits in each cloud store, who can reach it and how exposed it is — instead of merely listing applications.
Non-technical signals are just as useful: expense reports with recurring subscriptions, corporate card statements, per-department amnesty surveys, and the IdP itself (federated sign-ins to apps nobody approved).
Realistic governance: an approved-app catalogue with a fast onboarding path (days, not months), approval tiers based on data sensitivity, official alternatives for the most common needs and a policy that channels rather than bans. A blanket ban only pushes usage onto personal devices, where visibility is zero.
Example: shadow IT discovery in a 200-employee company
A mid-sized company deploys a CASB in discovery mode over its firewall and proxy logs. The result after two weeks: over 300 cloud services in use, of which IT knew about roughly 40. Among the findings: marketing uploading the customer database to an email tool nobody had contracted, a developer with the internal repository synced to a personal storage account, and half the workforce using a free AI chatbot — with contract fragments and personal data in the prompts. None of those tools had a data processing agreement, and the DPO knew about none of them.
The useful response was not indiscriminate blocking: services were triaged by risk, the ten most used were officially sanctioned (integrated with SSO and MFA), corporate alternatives were provided for generative AI and file storage, only the indefensible categories were blocked, and OAuth consents in the Microsoft 365 tenant were reviewed. The resulting inventory fed the record of processing activities and the third-party assessment NIS2 demands. Shadow IT did not disappear — it never does — but it went from a blind spot to a managed flow with quarterly review.
Common mistakes
- Banning without offering an alternative. If an employee needs to share a large file or transcribe a meeting and there is no official tool, the need does not vanish: it moves to their personal phone, where there is neither visibility nor control.
- Punishing whoever confesses. If admitting you use an unapproved tool has consequences, nobody will declare anything again and the inventory becomes fiction. Periodic amnesties uncover more than many scanners.
- Scanning once and filing the report. Shadow IT is a continuous flow, not a snapshot: without recurring discovery and periodic review, the inventory is obsolete within months.
- Ignoring OAuth consents. A third-party app with delegated permissions over corporate mail or files is shadow IT with persistent access, even though nobody installed anything on any machine.
- Treating shadow AI with domain blocking alone. Chatbots change domains, people connect from their phones, and AI features now ship embedded in legitimate tools; without a usage policy, training and a decent corporate alternative, blocking is cosmetic.
Related terms
Related services
This concept may be related to services such as:
Frequently asked questions
I run IT at an SMB and we have no CASB: where do I start discovering our shadow IT?
With what you already have. DNS and firewall logs tell you which cloud services your network talks to; the Microsoft 365 or Google Workspace admin centre lists third-party apps with OAuth consent; and expense reports expose SaaS subscriptions paid on company cards. Add a per-department amnesty survey — "which tools do you use that IT did not give you?" — with an explicit no-reprisals commitment. Those four sources give you a first inventory within a couple of weeks, and let you decide with data whether you need a CASB or whether tightening IAM and the app-approval process is enough for now.
My employees use ChatGPT and other AI tools on their own: how do I govern this without banning everything?
By channelling, not blocking. First, a short, clear usage policy: which data categories never go into a prompt (personal data, proprietary code, customer information) and which uses are allowed. Second, an official alternative: corporate accounts or enterprise plans with contractual no-training guarantees and controlled retention, integrated with SSO. Third, visibility: DLP controls adapted to AI channels plus review of extensions and plugins. Fourth, training with real examples from your sector. The pattern is consistent: where there is only prohibition, usage continues from personal phones; where a decent official alternative exists, most usage migrates to it. Our AI security service covers exactly this transition.
Can shadow IT put us in breach of GDPR even if no data breach happens?
Yes. If an employee processes personal data in a tool without a contract, that vendor is a processor without the Article 28 GDPR safeguards, and the controller — your organisation — is already non-compliant, breach or no breach. Add international transfers without a legal basis (many free SaaS tools host outside the EU), the impossibility of honouring erasure requests over data you cannot locate, and an incomplete record of processing activities. If an incident does occur, 72-hour notification is unworkable when nobody knew the tool existed. That is why a shadow IT inventory is not just technical hygiene: it is a practical compliance requirement your DPO must be involved in.
What is the difference between CASB and DSPM for tackling shadow IT, and which do I need first?
They answer different questions. A CASB answers "which cloud apps do my people use, and how risky are they?": it discovers services from network logs, scores them, and lets you sanction, restrict or block. DSPM answers "what sensitive data sits in each cloud store, and who can reach it?": it classifies information and detects exposures, including in apps you already approved. For the specific shadow IT problem, the CASB (or the equivalent capability in your SSE/proxy stack) usually comes first, because until you know which apps exist there is nothing to analyse. DSPM comes next, when the question shifts from "what do they use" to "what data is inside and how exposed am I".