Every organisation has tools nobody formally approved: a design subscription on a personal card, a project board a team started, a file-sharing account for a client who could not use the official one. Shadow IT is a symptom of friction, not of disobedience, and treating it as misconduct guarantees it stays hidden.
The actual risks
- Company and client data in services with no agreement, no assessed security, and no idea where it is stored.
- Access that persists after someone leaves, because the account was never known.
- Business-critical dependencies on accounts owned by an individual, which are lost when they go.
- Compliance exposure where personal data sits with an unassessed processor.
- Duplicate spend on tools the organisation already licenses.
How to find it
Expense reports and card statements are the fastest route — subscriptions show up as small recurring charges. Your identity provider will list applications granted access with company accounts. Ask teams directly what they use, framed as improving tooling rather than enforcing policy, which produces considerably more accurate answers.
Then absorb rather than ban
If a team adopted something, it solved a real problem. Bring it into the fold: move to a business tier under company billing, connect it to single sign-on, and add it to your offboarding checklist. Banning it without providing an alternative simply moves the same activity somewhere less visible.
Reduce the underlying friction
Shadow IT thrives where approved tools are missing, awkward, or slow to obtain. A lightweight request path with a quick decision, and a published list of approved tools with clear guidance on what may be stored where, removes most of the motivation for working around the process.
The minimum to maintain
A list of every service holding company or client data, who owns each relationship, what data it holds, and whether it is connected to single sign-on. That single document makes offboarding reliable, vendor incidents assessable, and questionnaires answerable.