A phenomenon that always starts with good intentions
Nobody creates an account on an external service to harm their company. Shadow IT, meaning the use of digital tools not approved by IT, almost always stems from a real, poorly met need: a file too large for email, an urgent share with a customer, a collaborative board handier than the one imposed, a document converter found in three clicks.
That is what makes it hard to deal with. Unlike obvious negligence, shadow IT is the symptom of a gap, and it is often driven by the most committed employees, those trying to work better and faster. Tackling the subject solely as a matter of blame leads to one thing only: the practices continue, but they stop being visible.
What it covers in practice in a small business
In a company without an IT department, the phenomenon takes clearly identifiable forms, rarely spectacular ones.
Personal storage is the most widespread case. A consumer cloud account used to carry work documents between office and home, sometimes created with a personal address, escapes the company's control entirely and outlives the employee's departure.
Applications installed freely on workstations come next: compression utilities, PDF readers, screenshot tools, browser extensions. Many are legitimate, some embed advertising or data collection, and a few are tampered versions of commercial software, with the risks that implies.
Subscriptions paid through expense claims form a third category, the most invisible financially. A tool subscribed to by one department, renewed automatically, never declared, whose cumulative cost ends up exceeding that of an official solution that would have met the need for the whole company.
Finally, generative AI services have joined the list very quickly. A contract dropped into an assistant to get a summary, an extract of the customer database pasted into an interface to be reformatted, internal code submitted for correction: these gestures take data out of the company without anyone perceiving them as a file transfer.
The real risk is not the one you imagine
The reflex is to think first of viruses or malware. That risk exists, but it is neither the most frequent nor the most costly.
Losing control over data is more serious. Work documents held on personal accounts are not backed up by the company, not covered by its procedures, and not recoverable if the employee leaves or loses access. A small business may discover, when someone leaves, that part of its commercial history was never stored on its own systems.
Compliance is the second blind spot. As soon as personal data about customers, employees or prospects passes through an unlisted service, the business can no longer say where it is, under which regime it is processed, or how long it is kept. Under the GDPR, this inability to map its processing is a failing in itself, regardless of any incident.
Password reuse, finally, turns a harmless service into an entry point. An account created on a free tool with the work password becomes exploitable as soon as that service suffers a leak. It is a mundane, effective attack vector that requires no particular skill.
Banning does not work
The instinctive response is to publish a charter of prohibitions and block whatever can be blocked. Experience shows the limits of this approach: practices shift to whatever is not blocked, or to personal devices, where the company has no visibility at all.
A ban without an alternative creates a worse situation than the starting point, because it removes the one thing that still made action possible: knowledge of real practices. An employee who knows they are breaking a rule will not report an incident that occurred on the tool concerned.
The effective approach reverses the logic. It starts from the observation that if an unapproved tool is being used, a need is not being met, and it addresses that need.
A realistic four-step method
The first step is the inventory, carried out without sanctions. A self-declared survey, announced as such, combined with a review of spending and of the applications installed on workstations, is usually enough to reveal the essentials. The aim is to know, not to punish.
The second step is sorting. Some of the tools identified are perfectly acceptable and deserve to be made official, sometimes with a business subscription that costs less than the scattered individual ones. Others cover a need already met by an existing service that users did not know about or found impractical. A few must be replaced, and that is where the business must offer an equivalent solution before withdrawing the old one.
The third step concerns rules. Rather than a list of prohibitions, a simple, understandable rule works better: which categories of data must never leave the company's systems, and who to ask to get a need approved. A light approval procedure, with an answer within a few days, discourages workarounds more effectively than strict but slow regulations.
The fourth step is technical. Identity and device management tools show which applications are present across the estate, list the services that work accounts sign in to, and apply a consistent policy. That is precisely one of the benefits of centralised management as described in our article on Microsoft 365 and Intune without an in-house IT department.
What the inventory reveals, beyond security
The exercise has a side effect that management does not anticipate: it brings to light dysfunctions that have nothing to do with IT security.
A file-sharing tool used heavily outside official channels usually signals that the solution in place is too slow, too limited in attachment size, or too complicated to use with external contacts. A spreadsheet shared on a third-party service to track orders often reveals that expensive line-of-business software does not cover a basic need. A consumer messaging app spontaneously adopted by a team frequently reflects an internal tool considered unusable on mobile.
Seen from this angle, the survey becomes a source of information on how the business really works, far more reliable than a satisfaction questionnaire about tools. Parallel practices show precisely where the official equipment fails, and they help direct the next investments towards observed gaps rather than assumed priorities.
The special case of generative AI
This point deserves separate treatment, because it is moving faster than internal rules and because it does not resemble the usual practices.
An outright ban is particularly counterproductive here: the tool is accessible from any browser or phone, and its usefulness is real. The tenable position is to define what may and may not be submitted, to steer people towards business offerings whose data usage terms are contractually clear, and to train teams on this precise point rather than relying on a charter nobody rereads.
A governance matter, not policing
Shadow IT cannot be eliminated; it can be reduced and channelled. A business that has surveyed its practices, made official what could be, and set understandable rules keeps enough visibility to steer, even though some undeclared practices will always remain.
It is work we build into our IT audit engagements, alongside cybersecurity awareness training, which addresses the human side, and GDPR compliance support when data mapping is at stake.