Shadow IT

Shadow IT used to mean unmanaged hardware and locally installed software; since the SaaS boom it mostly means cloud services adopted with a credit card or a free tier, OAuth-connected apps and browser extensions, and increasingly generative-AI tools. The last category is often called shadow AI; the widely reported 2023 case in which Samsung engineers pasted confidential source code into a public chatbot, after which the company restricted such tools, is the standard example. A useful distinction is between unsanctioned (nobody asked), tolerated (known but never assessed) and sanctioned-but-misconfigured services, because each needs a different response.

Discovery is primarily a logging problem. Cloud access security brokers and features such as Microsoft Defender for Cloud Apps Cloud Discovery parse firewall, secure web gateway, proxy or DNS logs, or take endpoint telemetry, match destinations against a catalogue of thousands of apps with risk scores (certifications, data residency, encryption, breach history) and show volume and users per app. Identity is the second lens: every "Sign in with Microsoft/Google" and every OAuth consent grant leaves an entry in the identity provider, and restricting user consent, routing requests through an admin consent workflow and reviewing granted scopes (for example Mail.Read or Files.ReadWrite.All) closes one of the most dangerous paths, because the app's access rests on the consent grant rather than on the user's password, so a password reset alone does not necessarily remove it. Expense reports and procurement data catch paid subscriptions that network logs miss, especially for remote staff off the corporate network.

The compliance consequences are concrete. An unknown service processing personal data is almost always a processor without a data processing agreement under GDPR Art. 28 (databehandleraftale), missing from the records of processing under Art. 30, and possibly a third-country transfer under Chapter V without an adequacy decision or appropriate safeguards. For the ISMS it breaks ISO/IEC 27001:2022 Annex A 5.9 (inventory of information and other associated assets), 5.23 (information security for use of cloud services, new in the 2022 edition) and 8.19 (installation of software on operational systems), and CIS Controls v8 Controls 1 and 2 on enterprise and software asset inventory. NIS2 Art. 21(2)(d) on supply-chain security and (i) on asset management assume the organisation knows its suppliers and assets in the first place.

Blocking alone tends to push usage further underground, onto personal devices and mobile data. Mature programmes treat discovered shadow IT as demand signal: a fast intake and assessment process, an approved alternative that is actually good enough, tiered policies (sanction, monitor, block) and data-loss prevention on the sanctioned channels. Security culture matters because the decisive moment is when an employee decides whether asking IT is worth the wait.