Shadow IT

Key takeaways

Shadow IT belongs to science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Shadow IT to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Shadow IT from memory before moving on to harder problems.

Reference excerpt

In organizations, shadow IT refers to information technology (IT) systems deployed by departments other than the central IT department, to bypass limitations and restrictions that have been imposed by central information systems. While it can promote innovation and productivity, shadow IT introduces security risks and compliance concerns, especially when such systems are not aligned with corporate governance.

Origins Information systems in large organizations can be a source of frustration for their users. In order to bypass limitations of solutions provided by a centralized IT department, as well as restrictions that are deemed detrimental to individual productivity, non-IT departments might develop independent IT resources for their own specific or urgent need or requirements. With a personal computer, PC Magazine said in 1984, "now every executive's secretary or assistant bookkeeper can bang out in 20 minutes what once took a team of MIS specialists 2 days to accomplish". In some cases, IT specialists could be recruited or software solutions procured outside of the centralized IT department, sometimes without the knowledge, or approval of corporate governance channels.

Benefits Although often perceived as attempts to undermine corporate governance, the existence of shadow IT often is an indicator of needs from individual departments not being satisfied from a centrally managed information ecosystem. Thus the immediate benefits of shadow IT are as follows:

Innovation: Shadow IT could be seen as a sandbox for potential or prototype solutions in response to evolution of changing business requirements. Also, alignment between departments can be enhanced depending on the constraints within the broader business. Individual productivity: Shadow solutions are customized to the needs of the individual departments and thus allow the individuals involved to be more effective. A study confirms that 35% of employees feel they need to work around a security measure or protocol to work efficiently. Reduced internal costs: Some shadow policies, such as BYOD, reduce direct hardware and software costs. Further, allowing localized support decreases overhead for IT departments.

Drawbacks In addition to information security risks, some of the implications of shadow IT are:

Costs: Additional time and investment could be incurred at a corporate level on additional integration, validation, and compliance of discovered shadow IT infrastructures. Relatedly, departments choosing the solutions with the lowest price-tag for their shadow solutions might not consider costs of deployment and maintenance. This can result in diminished return on investment in cases of insufficient buy-in. Consistency: As shadowed technical solutions might exist beyond centralized version control, they can potentially deviate from standardized methodologies or calculations. Multiple, coexisting shadow infrastructures also introduce a heavily fragmented application landscape. This can make centralized configuration management more difficult. Operating inefficiencies: Established shadow solutions might prevent overall implementation and adoption of more efficient processes due to widespread and habitual usage. The shadow system might also outstrip the capacity of the central IT department for integration and maintenance, especially when it becomes "too big to fail", or essential to vital processes of an organization.

Compliance

Shadow IT increases the likelihood of uncontrolled data flows, making it more difficult to comply with various legislations, regulations or sets of best practices. These include, but are not limited to:

Sarbanes-Oxley Act (US) Basel II (International Standards for Banking) GLBA (Gramm-Leach-Bliley Act), COBIT (Control Objectives for Information and related Technology) FISMA (Federal Information Security Management Act of 2002) DFARS (Defense Federal Acquisition Regulation Supplement) GAAP (Generally Accepted Accounting Principles) SOC (System and Organization Controls) HIPAA (Health Insurance Portability and Accountability Act) HITECH (Health Information Technology for Economic and Clinical Health Act) IFRS (International Financial Reporting Standards) ITIL (Information Technology Infrastructure Library) PCI DSS (Payment Card Industry Data Security Standard) GDPR (General Data Protection Regulation), CCPA (California Consumer Privacy Act) NYDFS (New York Department of Financial Services), PDPA (Personal Data Protection Act - Singapore)

Shadow AI The emergence of generative AI tools has introduced a distinct subset of shadow IT, commonly referred to as "shadow AI." Shadow AI refers to the use of artificial intelligence applications, including large language models (LLMs) and AI-powered productivity tools, by employees without the knowledge or approval of their organization's IT or security teams. The rapid consumer adoption of tools such as ChatGPT, GitHub Copilot, and similar AI assistants has accelerated shadow AI within enterprise environments. Employees frequently use these tools to assist with drafting documents, writing code, summarizing information, and analyzing data, often inputting sensitive organizational information in the process. A 2026 survey by cybersecurity company Vanta found that 70 percent of companies report shadow IT activity, with AI tools specifically identified as a growing concern. The report noted that large language models are more likely to be flagged as a security risk than traditional SaaS applications, and documented instances of employees reinstalling AI tools after IT departments had revoked access. Shadow AI introduces compliance risks beyond those of traditional shadow IT, as sensitive data entered into third-party AI systems may be used for model training or stored on external servers which can potentially violate data residency requirements and regulations such as GDPR.

… excerpt ends here. Continue reading the full article.

Worked examples

Example 1 — a first encounter with Shadow IT

Start with the simplest possible case. Write down what Shadow IT claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Shadow IT before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Shadow IT ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Shadow IT

In research: Shadow IT appears in science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Shadow IT in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Shadow IT is common in secondary-school and first-year university syllabi. It links to neighbouring topics Information systems, so understanding it makes those chapters shorter.
In everyday life: Look for Shadow IT outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

How to study Shadow IT in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Shadow IT means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Shadow IT out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Shadow IT in simple terms?

In organizations, shadow IT refers to information technology (IT) systems deployed by departments other than the central IT department, to bypass limitations and restrictions that have been imposed by central information systems. While it can promote innovation and productivity, shadow IT introduce…

Why does Shadow IT matter?

Because it connects several science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Shadow IT?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Shadow IT.