 | This article needs more citations. (August 2023) |
In organizations, shadow IT refers to information technology (IT) systems deployed by departments other than the central IT department, to bypass limitations and restrictions that have been imposed by central information systems. While it can promote innovation and productivity, shadow IT introduces security risks and compliance concerns, especially when such systems are not aligned with corporate governance.
Information systems in large organizations can be a source of frustration for their users. In order to bypass limitations of solutions provided by a centralized IT department, as well as restrictions that are deemed detrimental to individual productivity, non-IT departments might develop independent IT resources for their own specific or urgent need or requirements. With a personal computer, PC Magazine said in 1984, "now every executive's secretary or assistant bookkeeper can bang out in 20 minutes what once took a team of MIS specialists 2 days to accomplish". In some cases, IT specialists could be recruited or software solutions procured outside of the centralized IT department, sometimes without the knowledge, or approval of corporate governance channels.
Although often perceived as attempts to undermine corporate governance, the existence of shadow IT often is an indicator of needs from individual departments not being satisfied from a centrally managed information ecosystem. Thus the immediate benefits of shadow IT are as follows:
In addition to information security risks, some of the implications of shadow IT are:
 | The examples and perspectives in this section deal primarily with the United States and do not represent a worldwide view of the subject. (April 2026) |
Shadow IT increases the likelihood of uncontrolled data flows, making it more difficult to comply with various legislations, regulations or sets of best practices. These include, but are not limited to:
The emergence of generative AI tools has introduced a distinct subset of shadow IT, commonly referred to as "shadow AI." Shadow AI refers to the use of artificial intelligence applications, including large language models (LLMs) and AI-powered productivity tools, by employees without the knowledge or approval of their organization's IT or security teams.
The rapid consumer adoption of tools such as ChatGPT, GitHub Copilot, and similar AI assistants has accelerated shadow AI within enterprise environments. Employees frequently use these tools to assist with drafting documents, writing code, summarizing information, and analyzing data, often inputting sensitive organizational information in the process.
A 2026 survey by cybersecurity company Vanta found that 70 percent of companies report shadow IT activity, with AI tools specifically identified as a growing concern. The report noted that large language models are more likely to be flagged as a security risk than traditional SaaS applications, and documented instances of employees reinstalling AI tools after IT departments had revoked access.
Shadow AI introduces compliance risks beyond those of traditional shadow IT, as sensitive data entered into third-party AI systems may be used for model training or stored on external servers which can potentially violate data residency requirements and regulations such as GDPR.
Within an organization, the amount of shadow IT activity is by definition unknown, especially since departments often hide their shadow IT activities as a preventive measure to ensure their ongoing operations. Even when figures are known, organizations are reluctant to voluntarily admit their existence. As a notable exception, The Boeing Company has published an experience report describing the number of shadow applications which various departments have introduced to work around the limitations of their official information system.
According to Gartner, by 2015, 35 percent of enterprise IT expenditures for most organizations will be managed outside the central IT department's budget.
A 2012 French survey of 129 IT managers revealed some examples of shadow IT :
A 2026 survey by American cybersecurity company Vanta found that 70 percent of companies have shadow IT, with employees adopting AI tools without full security reviews or IT oversight. The report noted that large language models (LLMs) are more likely to be flagged as a security risk than traditional software-as-a-service applications. The issue extends to employee behavior, with the report documenting instances of employees reinstalling AI tools after IT departments have revoked access. The most commonly used applications identified were ChatGPT, Claude, and Cursor.
Examples of these unofficial data flows include USB flash drives or other portable data storage devices, instant messaging software, Gmail or other online e-mail services, Google Docs or other online document sharing and Skype or other online VOIP software—and other less straightforward products: self-developed Access databases and self-developed Excel spreadsheets and macros. Security risks arise when data or applications move outside protected systems, networks, physical location, or security domains.
BankAmerica employees began deploying personal computers within the company in late 1981. While the financial firm already extensively used large computers, as the data processing budget did not account for personal computers, individual employees and offices bought them and expensed them as office supplies. After the purchasing department in summer 1982 discovered unusually large purchases from Computerland stores, Bank of America allotted an acquisition budget for small computers and standardized on the IBM PC. By early 1983 all executives including president Sam Armacost reportedly had IBM PCs.
{{cite web}}: CS1 maint: url-status (link){{cite web}}: CS1 maint: deprecated archival service (link)