Shadow IT

In organizations, shadow IT refers to information technology (IT) systems deployed by departments other than the central IT department, to bypass limitations and restrictions that have been imposed by central information systems. While it can promote innovation and productivity, shadow IT introduces security risks and compliance concerns, especially when such systems are not aligned with corporate governance.

In organizations, shadow IT refers to information technology (IT) systems deployed by departments other than the central IT department, to bypass limitations and restrictions that have been imposed by central information systems. While it can promote innovation and productivity, shadow IT introduces security risks and compliance concerns, especially when such systems are not aligned with corporate governance. ==Origins== Information systems in large organizations can be a source of frustration for their users. In order to bypass limitations of solutions provided by a centralized IT department, as well as restrictions that are deemed detrimental to individual productivity, non-IT departments might develop independent IT resources for their own specific or urgent need or requirements. With a personal computer, PC Magazine said in 1984, "now every executive's secretary or assistant bookkeeper can bang out in 20 minutes what once took a team of MIS specialists 2 days to accomplish". In some cases, IT specialists could be recruited or software solutions procured outside of the centralized IT department, sometimes without the knowledge, or approval of corporate governance channels. ==Prevalence== Within an organization, the amount of shadow IT activity is by definition unknown, especially since departments often hide their shadow IT activities as a preventive measure to ensure their ongoing operations. Even when figures are known, organizations are reluctant to voluntarily admit their existence. As a notable exception, The Boeing Company has published an experience report describing the number of shadow applications which various departments have introduced to work around the limitations of their official information system. According to Gartner, by 2015, 35 percent of enterprise IT expenditures for most organizations will be managed outside the central IT department's budget. A 2012 French survey of 129 IT managers revealed some examples of shadow IT : Excel macro 19% Software 17% Cloud solutions 16% ERP 12% BI systems 9% Websites 8% Hardware 6% VoIP 5% Shadow IT support 5% Shadow IT project 3% BYOD 3%. A 2026 survey by American cybersecurity company Vanta found that 70 percent¹ of companies have shadow IT, with employees adopting AI tools without full security reviews or IT oversight. The report noted that large language models (LLMs) are more likely to be flagged as a security risk than traditional software-as-a-service applications. The issue extends to employee behavior, with the report documenting instances of employees reinstalling AI tools after IT departments have revoked access. The most commonly used applications identified were ChatGPT, Claude, and Cursor. ==Examples== Examples of these unofficial data flows include USB flash drives or other portable data storage devices, instant messaging software, Gmail or other online e-mail services, Google Docs or other online document sharing and Skype or other online VOIP software—and other less straightforward products: self-developed Access databases and self-developed Excel spreadsheets and macros. Security risks arise when data or applications move outside protected systems, networks, physical location, or security domains. BankAmerica employees began deploying personal computers within the company in late 1981. While the financial firm already extensively used large computers, as the data processing budget did not account for personal computers, individual employees and offices bought them and expensed them as office supplies. After the purchasing department in summer 1982 discovered unusually large purchases from Computerland stores, Bank of America allotted an acquisition budget for small computers and standardized on the IBM PC. By early 1983 all executives including president Sam Armacost reportedly had IBM PCs. ==References== ==External links== Discussion on Tech Republic [https://finance.yahoo.com/news/industrys-first-cloud-adoption-risk-120700575.html Industry's First Cloud Adoption and Risk Report [https://doksi.net/en/news.php?order=ShowArticle&id=1909] Shadow IT in the New IT Management Triangle

Text derived from https://en.wikipedia.org/w/index.php?oldid=1370918703 under CC BY-SA 4.0; modifications have been made.