Shadow IT

Schuyler Brown
Co-founder / CCO
Last updated on: November 9, 2022

Love ❤️ DevSecOps?
Get tips, guides, tutorials, & more in your inbox.

What is Shadow IT?

Shadow IT is software or hardware in use in an organization without the knowledge of the IT department. Business units or individuals may adopt cloud services, software, or devices without informing IT to help boost productivity. Shadow IT can result in application sprawl, inefficiencies, and security gaps exploitable by cyber attackers.

While IT oversight and approval of all technology in use are ideal in theory, in reality, they can be a bottleneck to innovation and productivity. This is why staff increasingly adopt and use software-as-a-service (SaaS), infrastructure-as-a-service (IaaS), and platform-as-a-service (PaaS) offerings at their own discretion. These services and applications can boost innovative and collaborative efforts, and many employees feel that IT involvement would stall them and reduce these benefits.

On the other hand, applications, services, and devices that are in use and off of IT’s radar may not be entirely secure. The consumerization of IT—cloud services and SaaS apps in particular—has made it easy to adopt shadow IT. In fact, at many enterprises, there are now hundreds of applications in use. Some of these applications may include features for file sharing, collaboration, or storage, which make them vulnerable to breaches or data leaks and may violate compliance rules.

Ordering a total halt on shadow IT adoption is not always feasible or even desirable for most organizations. On the other hand, log data from firewalls or proxies, cloud access security brokers (CASBs), and application-discovery software can help IT teams discover shadow IT. They can then assess the risk of specific IT, implement usage policies, address inefficiencies or redundancies, and standardize what IT deems secure.

Shadow IT Key Takeaways

  • The consumerization of IT and the proliferation of cloud services and SaaS apps have increased Shadow IT in organizations. 
  • Adopting shadow IT can help boost employees’ productivity and innovation. 
  • Application sprawl, inefficiencies, security gaps, and compliance issues are common side effects of Shadow IT 
  • Log data, application-discovery software, and cloud access security brokers can help IT teams bring shadow IT under control.

About the Author

, Co-founder / CCO, began working with startups as one of the first employees at Cross Commerce Media. Since then, he has worked at the venture capital firms DFJ Gotham and High Peaks Venture Partners. He is also the host of Founders@Fail and author of Inc.com's "Failing Forward" column, where he interviews veteran entrepreneurs about the bumps, bruises, and reality of life in the startup trenches. His leadership philosophy: be humble enough to realize you don’t know everything and curious enough to want to learn more. He holds a B.A. and M.B.A. from Columbia University. To contact Schuyler, visit him on LinkedIn.

More Glossary Terms

A
Active Directory (AD)

Active Directory (AD) is the proprietary directory service for Windows domain networks. It consists of a database and numerous services that connect users...

Advanced Threat Protection

Advanced threat protection is a type of cybersecurity dedicated to preventing pre-planned cyberattacks, such as malware or phishing. ATP combines cloud,...

Anomaly Detection

Anomaly detection is the process of analyzing company data to find data points that don’t align with a company's standard data pattern. Companies use...

Application Gateway

What is an Application Gateway (App Gateway)?An application gateway is a security measure that protects web applications. They replace traditional web...

Attack Surface

Your organization's attack surface is a collection of all the external points where someone could infiltrate your corporate network. Think of your attack...

Attribute-Based Access Control (ABAC)

A runtime decision-making strategy for what features and/or data a user can access based on policies and user attributes.

Audit Log

An audit log is a document that records what is happening within an IT system.

Authentication (Authn)

Authentication is the process of verifying a user or device before allowing access to a system or resources.

B
Bastion Host

A bastion host is a server used to manage access to an internal or private network from an external network - sometimes called a jump box or jump server.

Brute Force Attack

A brute force attack is a cyber attack where a hacker guesses information, such as usernames and passwords, to access a private system. The hacker uses...

C
CASB

Software or hardware that is either hosted in the cloud or on-premises. It adds a layer of security between users and cloud service providers and often...

CI/CD Pipeline

CI/CD (continuous integration/continuous deployment) is a collection of practices for engineering, testing, and delivering software. A CI/CD pipeline is...

Cloud Infrastructure Entitlement Management (CIEM)

Cloud Infrastructure Entitlement Management (CIEM, pronounced “kim”) is a category of specialized software-as-a-service solutions that automate the...

Cloud Workload Security

What is Cloud Workload Security?Cloud workload security is the practice of securing applications and their composite workloads running in the cloud....

Continuous Adaptive Risk and Trust Assessment (CARTA)

Continuous Adaptive Risk and Trust Assessment (CARTA) is an IT security framework that goes beyond traditional role-based access control (RBAC). By adding...

Credential Stuffing

Credential stuffing is a type of cyber attack that occurs when a person or bot steals account credentials, such as usernames and passwords, and tries to...

Cyber Insurance

Cyber insurance, also called cybersecurity insurance or cyber liability insurance, is an insurance policy that covers the losses a business might suffer...

D
Data Loss Prevention (DLP)

Data Loss Prevention (DLP) is a series of tools and practices that help companies recognize and prevent data exposure by controlling the flow of...

Data Observability

Data observability is the ability to understand, diagnose, and manage data health across multiple IT tools throughout the data lifecycle. A data...

Defense-in-depth

What is Defense-in-depth?Defense-in-depth began as a military term for a layered approach to protection. The NSA has taken that military strategy and...

Deprovisioning

Deprovisioning removes the access rights and deletes the accounts associated with a user on a network. When an organization offboards an individual, it’s...

Directory Services

What are Directory Services?A directory service is a database containing information about users, devices, and resources. This information, such as...

F
FIDO2

FIDO2 is the newest set of specifications from the FIDO Alliance. It enables the use of common devices to authenticate to online services on both mobile...

H
HIPAA

Compliance with the Health Insurance Portability and Accountability Act (HIPAA) means adhering to the rules and regulations that impact what, how, and...

HITRUST

HITRUST is a non-profit company that delivers data protection standards and certification programs to help organizations safeguard sensitive information,...

Honeypot

A honeypot is a phony digital asset designed to look like a poorly-guarded, valuable asset. The goal is to trick cyber attackers into targeting the...

I
Identity and Access Management (IAM)

Identity and access management (IAM or IdAM) is a framework containing the tools and policies a company uses to verify a user’s identity, authorize...

Identity as a Service (IDaaS)

Identity as a Service (IDaaS) is an identity and access management (IAM) solution delivered in a cloud-based service that is hosted by a trusted third...

Identity Governance and Administration (IGA)

Identity governance and administration (IGA), also called identity security, is a set of policies that allow firms to mitigate cyber risk and comply with...

Identity Lifecycle Management

What is Identity Lifecycle Management?Identity lifecycle management is the process of managing user identities and access privileges for all members of an...

Insider Threat

An insider threat is a threat to an organization that occurs when a person with authorized access—such as an employee, contractor, or business...

ISO 27001 Compliance

ISO/IEC 27001, or ISO 27001, is the international standard that defines best practices for implementing and managing information security controls within...

J
Just-in-Time (JIT) Access

Just-in-time (JIT) access is a feature of privileged access management (PAM) solutions to grant users access to accounts and resources for a limited time...

L
Lateral Movement

Lateral movement is when an attacker gains initial access to one part of a network and then attempts to move deeper into the rest of the network —...

M
Man-in-the-Middle (MITM) Attack

A man-in-the-middle (MITM) attack is a cyber attack in which a threat actor puts themselves in the middle of two parties, typically a user and an...

Microsegmentation

Microsegmentation is a network security practice that creates secure zones within data center environments by segmenting application workloads into...

N
Network Segmentation

Network segmentation (also known as network partitioning or network isolation) is the practice of dividing a computer network into multiple subnetworks in...

NIST

NIST compliance broadly means adhering to the NIST security standards and best practices set forth by the government agency for the protection of data...

O
Observability

Observability is defined as a measure of how well the internal states of a system can be inferred from knowledge of its external outputs.

P
Passwordless Authentication

Passwordless authentication is a verification method in which a user gains access to a network, application, or other system without a knowledge-based...

PCI Compliance

PCI compliance—or payment card industry compliance—is the process businesses follow to meet the Payment Card Industry Data Security Standard (PCI DSS).

Principle of Least Privilege (PoLP)

‍In network security, least privilege is the practice of restricting account creation and permission levels to only the resources a user requires to...

Privileged Access Management

Privileged access management (PAM) encompasses the policies, strategies, and technologies used to control, monitor, and secure elevated access to critical...

Privileged Session Management

What is Privileged Session Management? Privileged session management (PSM) is an IT security process that monitors and records the sessions of privileged...

R
Robotic Process Automation (RPA) Security

What is Robotic Process Automation (RPA) Security? Robotic process automation (RPA) is software that mimics human actions to automate digital tasks....

Role-based access control (RBAC)

Role-based access control (RBAC) is a security approach that authorizes and restricts system access to users based on their role(s) within an organization.

S
SAML

SAML is a popular online security protocol that verifies a user’s identity and privileges. It enables single sign-on (SSO), allowing users to access...

Secrets Management

Secrets management is a cybersecurity best practice for securing digital authentication credentials. It relies on various tools and methods to store,...

Secure Access Service Edge (SASE)

Secure Access Service Edge (more commonly known by the SASE acronym) is a cloud architecture model that combines network and security-as-a-service...

Security Incident Response Policy (SIRP)

A Security Incident Response Policy (SIRP) establishes that your organization has the necessary controls to detect security vulnerabilities and incidents,...

Security Operations (SecOps)

Security Operations (SecOps) is a methodology that fuses IT operations and information security. Its goal is to reduce security risks and vulnerabilities...

Shadow IT

What is Shadow IT? Shadow IT is software or hardware in use in an organization without the knowledge of the IT department. Business units or individuals...

SOC 2

SOC 2 stands for “Systems and Organizations Controls 2” and is sometimes referred to as SOC II. It is a framework designed to help software vendors and...

Software-Defined Network (SDN)

With a software-defined network, networking devices directly connect to applications through application programming interfaces (APIs), making SDN...

SOX Compliance

SOX compliance is an annual obligation derived from the Sarbanes-Oxley Act (SOX) that requires publicly traded companies doing business in the U.S. to...

W
WebAuthn

WebAuthn is the API standard that allows servers, applications, websites, and other systems to manage and verify registered users with passwordless...

Z
Zero Trust

Zero Trust is a modern security model founded on the design principle “Never trust, always verify.” It requires all devices and users, regardless of...

Zombie Accounts

Zombie accounts: forgotten accounts that open the door to bad actors looking to insert malware, steal data, and damage your internal systems.

StrongDM People-first Infrastructure Access Wizard

See StrongDM in Action