Table of contents
Highlights
- Shadow IT represents a significant and often invisible portion of enterprise IT spending that security teams struggle to track.
- Employees bypass IT because sanctioned tools and procurement processes struggle to match the pace of business needs.
- Unchecked shadow IT expands your attack surface and can trigger significant regulatory fines under frameworks like GDPR and HIPAA.
- Shadow AI is the fastest-growing dimension of the problem, with a growing share of IT leaders reporting concern about unauthorized AI tool usage.
- The most effective shadow IT strategies shift from prohibition to enablement, making approved tools faster and easier than unauthorized alternatives.
- Moveworks customers use an agentic AI platform that can give employees fast, sanctioned access to tools and answers, helping reduce the friction that drives shadow IT.
Your IT team believes it manages around 100 cloud applications. The actual number running across your organization is closer to 1,000.
That gap creates significant governance challenges, especially as AI tools become more widely adopted. Recent research found that 66% of employees use unauthorized AI tools.
Together, these trends can leave a substantial portion of an organization’s technology environment outside established security controls, compliance reviews, and budget planning.
The employees behind those numbers are acting out of necessity, not malice, as they struggle to match the speed of business. And that distinction matters, because it changes the entire approach you need to take.
This article is designed to help CISOs and CIOs understand the true cost of shadow IT across security, compliance, and budget, and build a management strategy that addresses root causes instead of chasing symptoms.
What is shadow IT?
Shadow IT is any hardware, software, or cloud service used within your organization without the knowledge or approval of your IT department. It ranges from personal Dropbox accounts and unsanctioned SaaS subscriptions to unauthorized AI tools that employees adopt to get work done faster.
The concept isn't new, but the scale has changed.
A decade ago, shadow IT meant a rogue server under someone's desk. Today, anyone with a corporate credit card (or even a personal one) can spin up a cloud service in minutes. This behavior has become more common as employees try to keep up with changing business priorities and technology.
Common examples of shadow IT in the enterprise
Shadow IT has the potential to show up in virtually any department:
- Personal cloud storage: A sales rep stores client files in a personal Google Drive or Dropbox account for easier access on the road, moving sensitive data outside IT's control.
- Unapproved project management tools: A marketing manager signs up for Trello or Asana because the approved platform feels clunky, fragmenting workflows across unsanctioned systems.
- Unauthorized messaging apps: Teams coordinate over WhatsApp or Signal to get faster responses than official channels provide, creating communication records IT can't monitor or retain.
- Shadow cloud infrastructure: An engineering team spins up an unapproved cloud instance to test a new feature without waiting weeks for provisioning, bypassing security review entirely.
- Personal AI assistants: An HR analyst pastes employee survey data into a consumer AI tool to speed up analysis, sending sensitive information to a third-party model with no audit trail.
- BYOD devices: Employees access corporate systems from personal laptops and phones that lack endpoint protection, encryption, or mobile device management.
Each of these scenarios starts with a reasonable productivity need, and each one creates risk that security teams can't see, let alone manage.
Why employees turn to unauthorized tools
Employees often turn to shadow IT because sanctioned IT processes are too slow, complex, or misaligned with what they need to get their jobs done. This is an IT service delivery failure.
The root causes are consistent across organizations:
- Procurement cycles that take weeks when teams need tools now.
- Approved storage that maxes out before the quarter ends.
- Collaboration platforms that don't support external sharing with contractors or partners.
- Enterprise applications that technically offer the right features but bury them under so many layers of configuration that people default to consumer alternatives.
When as many as 67% of employees are working around their company's security policy to get their work done, it signals a gap between what IT provides and what employees need. Understanding that gap can help organizations measure and improve the employee experience.
The security risks of unchecked shadow IT
Unchecked shadow IT expands your attack surface, creates compliance gaps, and leaves security teams with no visibility into the assets they need to protect. You can't patch software you don't know exists, enforce access controls on platforms you haven’t vetted, or include untracked tools in your incident response plan.
Data exposure and compliance violations
When employees store sensitive data in unsanctioned tools, that data may enter environments that haven't been assessed for regulatory compliance.
For example, a team member uploads customer records to a personal cloud storage account hosted in a jurisdiction that doesn't meet GDPR requirements, and the organization has a data residency violation it didn't know existed.
The financial exposure is significant:
- Under GDPR, severe violations can result in fines of up to €20 million or 4% of global annual turnover, whichever is higher.
- HIPAA civil monetary penalties can reach $25,000 per violation per category.
- For organizations undergoing SOC 2 examinations, processing customer data outside assessed environments can also create control gaps and complicate the audit process.
The risks can remain unaddressed when your security team hasn’t reviewed the tools involved.
Expanded attack surface and breach liability
Every unauthorized tool creates an unpatched, unmonitored entry point that falls outside your security team's remediation scope. These tools often lack enterprise-grade authentication, don't integrate with your identity provider, and rely on weak or reused credentials that nobody tracks.
Rogue AI agents can add another layer of risk. Agents with broad system access may operate outside established governance and, without appropriate controls, could be manipulated through prompt injection or other attacks to take unauthorized actions at scale.
According to the IBM Cost of a Data Breach Report 2025, the global average cost of a data breach is $4.44 million.
Unsanctioned applications also complicate breach detection. When a compromised tool doesn't appear in your asset inventory, the breach can persist for months before anyone notices. For organizations looking to balance employee data protection with accessibility, understanding this dynamic is critical.
How shadow IT drains your IT budget
The financial impact of shadow IT extends well beyond security incidents. Shadow IT contributes to a broader SaaS spending problem. An analysis of more than $34 billion in SaaS spend found that over one-third of company applications were shadow IT, while organizations averaged $18 million in annual waste from unused and inefficiently managed software licenses.
The cost mechanisms compound quickly:
- Duplicate subscriptions: Multiple teams purchase overlapping SaaS tools that serve the same function, each paying separately.
- Lost volume pricing: Individual department purchases bypass enterprise licensing agreements, paying retail rates for capabilities the organization could negotiate at scale.
- Orphaned licenses: Subscriptions pile up as employees change roles or leave the company, and nobody cancels them because nobody knows they exist.
- Unowned tools: Products that lack a clear owner, contract, or approval make up an estimated 10% to 15% of a company's tech stack.
All of this adds up to budget leakage that grows every quarter, and the only way to address it is to first gain visibility into what your organization is actually running.
Shadow AI: The next frontier of unsanctioned risk
Shadow AI represents the fastest-growing dimension of the shadow IT problem, and it introduces risks that traditional governance models were never designed to address.
The key difference is that shadow AI influences decisions, generates content, and processes sensitive information through opaque third-party systems.
When a finance analyst pastes quarterly projections into a consumer AI tool, or a product manager feeds a competitive strategy document into an unvetted large language model, the data leaves the organization's control entirely. The organization may then have limited visibility into how the tool processes the information, uses it to generate outputs, or retains the underlying data.
Shadow AI is a current exposure that demands dedicated governance alongside your broader shadow IT strategy. One study found that 63% of organizations lacked AI governance policies designed to manage AI use or address unauthorized tools among employees. Without clear policies, unauthorized AI use can introduce security vulnerabilities that remain outside established monitoring and review processes.
Understanding how to protect employee data privacy in the AI era is now a core responsibility for security leaders.
How to build a shadow IT management strategy that works
The most effective shadow IT management strategies shift from prohibition to enablement. Strict bans may push unauthorized tool usage further underground, reducing visibility while leaving the underlying need unresolved.
Start with discovery, not prohibition
You can only manage the tools you know about. Visibility is the foundation of an effective governance program, and it needs to be continuous instead of a periodic audit. Here’s what that might look like:
- Cloud access security brokers (CASBs) can detect unauthorized SaaS usage by analyzing cloud traffic and API integrations.
- Attack surface management platforms can identify externally facing assets that your team didn't provision.
- Network monitoring tools can flag unusual outbound traffic tied to unfamiliar services.
The goal is to build a real-time inventory of what's actually running across your organization so you can make informed risk decisions about what to sanction, what to migrate, and what to retire.
Make sanctioned tools the path of least resistance
Discovery tells you what exists, and the root fix for shadow IT is better service delivery. When sanctioned tools are fast, intuitive, and easy to access, employees don’t need to seek out alternatives. That may involve:
- Streamlining procurement so teams can get approved tools in days rather than weeks.
- Investing in platforms that employees actually want to use, not just platforms that check IT's compliance boxes.
- Creating self-service channels where employees can find answers, request access, and resolve issues without filing a ticket and waiting.
An agentic AI platform can play a central role here. Instead of requiring employees to navigate complex service portals or wait in support queues, it can provide a single front door to sanctioned support. That may include automated provisioning, self-service answers, and policy-compliant access through tools employees already use, like Slack and Teams. Making the approved path faster and easier can reduce employees’ incentive to seek workarounds.
How improving employee experience addresses shadow IT at its root
Shadow IT often signals that an organization’s operating model has not kept pace with employees’ needs. Addressing that gap through automated discovery, streamlined procurement, and AI-powered self-service can help reduce risk while making sanctioned tools easier to use.
Organizations that succeed against shadow IT ultimately deliver better experiences, combining real-time visibility with frictionless access that makes sanctioned tools the obvious choice.
Your security strategy should support both productivity and compliance.
See how Moveworks helps organizations reduce risk while improving the employee experience.
Frequently Asked Questions
Shadow IT refers to any hardware, software, or cloud service used within your organization without the knowledge or approval of the IT department. It includes unsanctioned SaaS applications, personal cloud storage accounts, unauthorized messaging tools, and AI assistants that employees adopt on their own to get work done faster.
Employees typically turn to unauthorized tools because sanctioned IT processes are too slow, too complex, or fail to meet their needs. Common triggers include lengthy procurement cycles, limited storage options, inability to share files with external collaborators, and approved tools that lack required functionality.
Shadow IT expands your attack surface by introducing unpatched, unmonitored systems that fall outside security teams' protection. It also creates compliance gaps that may lead to GDPR, HIPAA, or SOC 2 violations, and it increases the likelihood of data breaches through weak or abandoned credentials on unsanctioned platforms.
Shadow AI is the unauthorized use of generative AI tools in the workplace without IT oversight. Unlike traditional shadow IT, shadow AI can influence business decisions, generate customer-facing content, and process sensitive data through third-party models with no audit trail, making it a fast-growing governance concern.
The most effective approach combines automated discovery tools with faster, more intuitive sanctioned alternatives. Rather than banning unauthorized tools outright, organizations can deploy AI-powered self-service platforms and streamlined procurement processes that make approved channels the easiest path for employees.
Shadow IT is typically driven by productivity needs, not malicious intent. Employees use unauthorized tools because official channels fall short. Insider threats, by contrast, involve deliberate misuse of access privileges to steal data, sabotage systems, or cause harm. The two can overlap when shadow IT creates vulnerabilities that malicious actors exploit.
