Shadow IT is any software, app, device or online service that employees use for work without their IT team knowing about it or approving it. Businesses should care because every unapproved tool is another place company data can end up without the security, backups or oversight you would expect.
It’s rarely done with bad intentions. Picture a project manager who needs to send a large file to a client, finds sharing it through the company’s Google Drive awkward and uploads it to a free file-sharing site instead. The job gets done, but that file now sits on a service nobody in the business controls, possibly forever. Multiply that across a whole team and it’s easy to see why shadow IT is a real concern.
What Is Shadow IT? Common Examples at Work
Shadow IT can take many different forms, depending on the technology employees use day to day. Some of the most common examples include:
Cloud Storage
Personal cloud storage is one of the most common examples of shadow IT. An employee might save work files to their personal Dropbox or Google Drive so they can pick them up at home, without thinking twice. Once the files are there, the business has no say over where they’re stored, who can see them or whether they’re deleted when that person leaves.
Business-grade cloud storage gives staff the same convenience while keeping the business in control.
Messaging Apps
Messaging apps become shadow IT when work conversations move onto personal accounts. It’s often quicker to send a WhatsApp message than open an approved business platform, but client details, documents and decisions then sit on personal phones, outside anything the business can search, back up or retrieve.
Generative AI
Generative AI is the fastest-growing form of shadow IT, so much so that it now has its own name: shadow AI. Research commissioned by Microsoft in October 2025 found that 71% of UK employees had used unapproved consumer AI tools at work, with 51% doing so every week. Free tools such as ChatGPT and Claude are useful for writing and research, but when staff paste in client information, contracts or financial data, that information leaves the business’s control.
Devices
Shadow IT isn’t limited to software and online services. Personal laptops, phones and tablets used for work without the IT team’s knowledge are part of it too. These devices may be missing security updates, antivirus or encryption, and if one is lost or stolen, there may be no way to wipe the business data stored on it.
Why Shadow IT Is Becoming More Common
Technology is now part of everyday life, and employees bring the same habits to work. Most apps and AI tools are free or cheap, take minutes to sign up for and need no help from IT. So when an approved tool feels slow or doesn’t do the job, it’s easy to find one that does.
The rise of hybrid and remote working has accelerated this. With staff working from home, on the move and across different devices, they have more freedom to choose how they communicate, store files and complete tasks. That may seem like a positive for employees, and in many ways it is, but it makes it much harder for businesses to keep track of which tools are being used and where their data is going.
The Risks of Shadow IT for Your Business
Shadow IT can seem harmless, but every unapproved tool is a gap in your visibility. Without the right controls in place, you can lose track of where data is stored, who can access it and how well it’s protected. The main risks include:
- Data leaks and breaches
Files and messages stored on personal accounts can be shared, forwarded or left open to the wrong people, often without anyone noticing. Leaks involving personal or customer data are data breaches, and your business is still responsible for them. - Cyber attacks
Personal devices and unvetted apps may not have the cyber security protections your business relies on, giving attackers an easier way in. A single compromised account can expose far more than the employee realises. - UK GDPR compliance
Under UK GDPR, you need to know where personal data is held and make sure it’s handled securely. That’s difficult when data sits in tools you don’t know exist, and serious failings can lead to investigations and fines from the Information Commissioner’s Office. - Lost data when staff leave
When an employee leaves, any work stored in their personal accounts often leaves with them, along with access to client conversations and files. - Downtime and lack of support
IT can’t fix or secure a tool it doesn’t know about, so when something goes wrong, staff can lose hours on a problem IT could have solved in minutes. - Scattered data
When information is spread across lots of different apps, it becomes harder to find, report on and trust. - No backups and wasted spend
Unapproved tools are rarely backed up by the business, and different teams often end up paying for several tools that do the same job.
Why Banning Tools Alone Isn’t Enough
Faced with these risks, the natural reaction is to block unapproved tools outright. That’s sensible, but a ban on its own rarely solves the problem. Shadow IT is usually a sign that staff need something their approved tools aren’t giving them. Take a tool away without offering another route, and people will simply find a workaround.
That’s why every ban should come with a clear approval process. Staff should know who to ask, what information to provide and how quickly they’ll get an answer. If a tool is safe, approve it and add it to your list. If it isn’t, offer a secure alternative that does the same job. Over time, these requests also show you where your approved tools are falling short, so the business stays in control without slowing anyone down.
Practical Steps for Reducing Shadow IT
To reduce shadow IT, businesses need to make the right tools the easiest option while still keeping control of their technology. Practical steps include:
- Set clear IT policies
Write a short, plain-English policy covering which tools are approved, what data can go into them and what to do if someone needs something new. Include AI tools specifically. - Provide approved tools that do the job
If staff are using WhatsApp or personal Dropbox accounts, give them a business equivalent, such as Teams or SharePoint, that’s set up properly and easy to use. - Educate employees
Explain the risks in practical terms, with real examples, so staff understand why it matters rather than seeing policy as red tape. - Monitor software and devices
Use device management and app discovery tools to see what’s running on your network and which cloud services staff are using. - Make tool approval simple
Aim to respond to requests within days, not weeks, or people will work around the process. - Regularly review access
Check who has access to which systems and remove it promptly when people change roles or leave. - Keep systems and devices secure
Make sure every device used for work is updated, encrypted and protected, including personal devices covered by a bring-your-own-device policy.
Shadow IT FAQs
Is shadow IT illegal?
No, using an unapproved app isn’t illegal in itself. But if it leads to personal data being mishandled or exposed, your business could be in breach of UK GDPR.
What is shadow AI?
Shadow AI is the use of AI tools, such as ChatGPT, without the business’s approval. It’s a form of shadow IT that carries the same risks, particularly when staff paste in sensitive information.
What is an example of shadow IT?
Common examples include saving work files to a personal Dropbox account, discussing clients on WhatsApp or pasting company data into a free AI tool.
Can shadow IT ever be a good thing?
It can show you where your approved tools are falling short. Treat it as feedback, then give staff a secure alternative that meets the same need.
How Intrasource Can Help
Reducing shadow IT starts with having the right systems, security and support in place, and that’s where we come in. Through our managed IT support, cloud services and cyber security solutions, we help businesses take back control of their technology. We can identify where your data is going, manage your devices and systems, and make sure your team has secure, approved tools they actually want to use.
If you’re unsure what tools your team is using, or want help putting the right controls in place, get in touch with our friendly team today.
