What Is Shadow IT? Examples, Risks, and How a Small Business Manages It

Shadow IT is any app, cloud service, account, or device your staff use for work that your business hasn't approved or doesn't know about. A personal Dropbox holding client files counts. So does a free project tool one department signed up for, and so does work email forwarded to a personal inbox. Most of it starts with good intentions. The trouble is simple: you can't back up, secure, or recover data you don't know exists.

What are common examples of shadow IT?

In your business, shadow IT probably looks ordinary. You may already use some of it yourself. Someone sends large files through a personal file-sharing account because email bounced the attachment. A team tracks its projects on a free online board registered to a personal email address. A manager puts a scheduling or e-signature tool on the company card and tells no one. Staff install browser extensions that can read every page they open. Others text client details from personal phones, or forward work email to a personal account so they can read it at home. But to the person doing it, none of this feels like a security decision.

Why do employees use shadow IT?

Your staff turn to shadow IT when the approved way is slow or unclear, or when there isn't one. If approving a new tool takes three weeks, people sign up for a free one today. When nobody has told them which file-sharing service the business uses, they fall back on whatever they use at home. And shadow IT rarely means bad intent. It means your approved tools or your approval process don't fit how people actually work. It's a management problem as much as a technical one.

What are the risks of shadow IT?

The biggest risk for you is data you can't see. Files in a personal account aren't in your backups, so a deleted folder stays deleted. Because they sit outside your security controls, a weak password or missing multifactor authentication on that account exposes client data. And a former staff member can still hold your files, since they don't leave when the employee does. Compliance is at stake too. If you work under HIPAA, the FTC Safeguards Rule, or a client contract, data stored in an unapproved service can put you out of compliance without anyone knowing.

Is shadow IT an insider threat?

For your business, shadow IT usually isn't an insider threat in the malicious sense. But it creates the same exposure. An insider threat is anyone with legitimate access who puts your data at risk, on purpose or by accident. Most shadow IT is accidental. A well-meaning employee picks convenience, and sensitive data ends up outside your control all the same. Treat shadow IT as a visibility gap to close, not as misconduct to punish. Staff who fear punishment hide their tools, and you end up seeing even less.

How do you discover shadow IT without spying on your staff?

You can start by asking. A short survey or team conversation about the tools people use to get work done often turns up more than any scan. Then check the records you already have: company card statements for software subscriptions, and the third-party apps staff have connected to Microsoft 365 or Google accounts. And look at which devices sign in to company email. If you use Microsoft 365, tools such as Microsoft Defender for Cloud Apps can show which cloud services are in use from your network and managed devices. Write it all down in a simple inventory, with an owner assigned to each tool.

Microsoft explains how Defender for Cloud Apps discovers shadow IT.

How do you manage shadow IT instead of banning it?

Your goal is to make the approved path faster than the workaround. For each tool you find, decide whether to approve it, replace it with something you already pay for, or retire it. Set up approved tools under company accounts with multifactor authentication, and add them to your backup and offboarding steps. And publish a short list of the tools your business uses for file sharing, messaging, and projects, along with a simple way to request something new. Answer those requests in days instead of weeks, and your staff stop needing shadow IT.

Keep your inventory current. CISA lists keeping an asset inventory, including software and cloud services, among the baseline practices it recommends for organizations of every size. Review yours at least quarterly. Review it again whenever someone joins or leaves.

CISA describes asset inventory in its Cross-Sector Cybersecurity Performance Goals.

What should your approved tools list include?

Your list only needs one line per job. Name the tool your business uses for file sharing, internal chat, video calls, project tracking, e-signatures, password management, and AI assistance. Add who to ask for access. And spell out what's off limits, such as personal email for client files or personal cloud storage for anything with client names. Keep it to one page your staff can find in a minute. If the list says to use SharePoint for client files, make sure everyone has access and knows how to use it, or the old workaround comes back.

What happens to shadow IT when an employee leaves?

This is where shadow IT hurts you most. Your offboarding checklist shuts off the company email account and collects the laptop, but it can't revoke access to a personal file-sharing account or a free tool registered to a personal address. And any client files in those places leave with the person. In every exit conversation, ask about personal accounts used for work, and transfer or delete that data before the last day. Better yet, put every tool you approve on a company account. Offboarding then covers it automatically.

Use our IT onboarding and offboarding checklist.

How is shadow AI different from shadow IT?

Shadow AI is the newest form of shadow IT you'll run into: staff pasting client data into AI chat tools the business hasn't approved. The risk is the same: data leaving your control. It just happens faster, because one prompt can hold an entire client file. So handle it the same way. Find out what people use, approve a business-grade option, then write down what data can and can't go into it.

Read our guide to the risks of shadow AI at work.

See how mobile device management protects company data on every device.

Learn how dark web monitoring spots exposed staff credentials.

Read the BYOD policy guide for personal phones and laptops.