Shadow IT is the set of devices, services and tools that people use for work without the organization knowing about them. The NCSC describes these as unknown assets used for business purposes. They sit outside normal IT processes and policy.
- Also Called3other namesshadow technology · unsanctioned IT · unapproved IT
- Related Terms3linked entriesShadow AI · Attack surface · Exposure management
What is shadow IT?
The NCSC describes shadow IT as the unknown assets that are used within an organization for business purposes. This includes unauthorized devices and cloud services used for work. The key point is that the organization does not know about them, so they are not managed through its usual IT processes or policy.
Why does shadow IT appear?
The NCSC says shadow IT is rarely malicious. It usually comes from people trying to get their work done. The NCSC lists common causes: corporate tools that lack a needed function, approval processes that are slow or ineffective, missing services such as storage or collaboration, and staff who are unaware of the security risks.
As a simple illustration, someone who cannot get an approved tool quickly may sign up for a free online service instead. This is a generic example, not a description of a real case.
Why does it matter?
The NCSC warns that shadow IT lacks protections such as encryption, access controls and monitoring, which leaves data open to theft or ransomware. Devices without firewalls, antivirus or multi-factor authentication can enable malware, network monitoring and lateral movement, which means an attacker moving from one system to another.
How can you find shadow IT?
The NCSC suggests several technical ways to find it:
- Network access controls, so unknown devices cannot join easily.
- Asset management that tracks the devices you expect to see.
- Network scanning tools that spot devices you do not recognize.
- Cloud access security brokers, which give visibility of cloud services.
- Unified endpoint management tools for monitoring.
How can you reduce it?
The NCSC puts the focus on people as well as tools. It advises meeting the real user need with approved alternatives, making requests for new services simple and quick, giving people a controlled way to reach outside services, and building a transparent, no-blame security culture.
Is shadow IT the same as shadow AI?
No. Shadow AI is one form of the same pattern, where people use AI tools that the organization has not approved. Shadow IT is the wider idea and covers any unapproved device, service or tool.
Is shadow IT the same as an insider threat?
Not by default. The NCSC says shadow IT is usually not driven by bad intent. An insider threat involves a person who misuses access on purpose or by mistake. Shadow IT can add risk without anyone meaning harm.
Related pages in the Knowledge Hub
Also Called.
- Nameshadow technology
- Nameunsanctioned IT
- Nameunapproved IT
Questions.
-
What is shadow IT?
Shadow IT is the set of devices, services and tools that people use for work without the organization knowing about them. The NCSC describes them as unknown assets used for business purposes, outside normal IT processes and policy.
-
Why does shadow IT happen?
The NCSC says it is rarely malicious. Common causes are corporate tools that lack a needed function, slow or ineffective approval processes, missing services such as storage, and staff unaware of the security risks.
-
Why is shadow IT a risk?
Unknown assets lack protections such as encryption, access controls and monitoring, which leaves data open to theft or ransomware. Devices without firewalls, antivirus or MFA can also enable malware and lateral movement.
-
How can I find and reduce shadow IT?
The NCSC suggests network access controls, asset management, network scanning and cloud access security brokers to find it. To reduce it, offer approved alternatives, make requests quick and build a no-blame culture.
Sources
In Our Research
- 1 Shadow IT: Why the Assets Your IT Team Doesn’t Know About Are Your Most Dangerous Entry Points July 2026
- 2 The Silent Threat of Shadow IT: Detection and Mitigation Strategies December 2024
- 3 Ransomware Evolution: Analyzing the Next Generation of Cyber Heists December 2024
- 4 Attack Surface Management Tools: A Buyer’s Guide 101 guide