What is shadow IT?
Shadow IT covers any technology people use for their jobs that IT and security never approved or even knew about. Typical cases look ordinary:
- A department pays for a file-sharing or project-management service with a corporate card.
- A developer builds and tests in a personal cloud account.
- Employees paste work documents into AI chatbots the company never approved.
- Someone installs a browser extension that can read every page they open.
- Staff forward files to personal email to work on them at home.
Malice is rarely involved. People reach for these tools because they get the job done faster than going through the official process.
Why shadow IT is a vulnerability
The risk is the unmanaged service itself. Because it never went through review, several protections are missing at once:
- No vendor review. Nobody checked the provider's security controls, breach record or contract.
- Weak accounts. Users sign up with separate passwords, often reused ones, outside central sign-in, so MFA and conditional access never apply.
- No offboarding. When the employee leaves the company, the account and everything stored in it go too.
- No data controls. The files fall outside data loss prevention, retention, legal hold and backup, and may be stored in a country your regulations prohibit.
- No breach notice. If the provider is compromised, you may never find out your data was there.
How organizations discover it
Unsanctioned services leave traces in logs and paperwork. Three places reveal them:
| Source | What it reveals |
|---|---|
| Cloud access security broker (CASB), often delivered as part of a security service edge platform | Reads proxy, firewall and DNS logs, lists the cloud services in use and scores each one's risk |
| Identity provider | Shows which third-party apps users have let into their mailbox or files through OAuth consent |
| Expense reports and corporate-card statements | Expose subscriptions that IT never purchased |
Responding without driving it underground
What happens after discovery matters as much as the discovery. Blocking everything that is not approved tends to make people hide their usage better. A more effective response combines several steps: provide approved alternatives for the needs people keep solving on their own, make it quick to request a new tool, require an administrator to approve OAuth app grants, and reserve outright blocking for the services that carry real risk. An acceptable-use policy and user training make the expectations clear.
Shadow IT vs. rogue devices and insider threats
An unapproved device plugged into the network is unsanctioned too, but the better name for it is a rogue device, and network access control is how it is found. Shadow IT refers to unapproved services and the data people move into them. It also differs from an insider threat, which requires an intent to do harm; a shadow IT user is normally just trying to finish their work. If a question asks how to find unsanctioned cloud services in use across the organization, choose a CASB. A vulnerability scanner is the wrong tool, because it only sees systems on your own network.
Shadow IT on the CompTIA Security+ exam
Shadow IT appears among vulnerability types and attack surfaces under objective 2.4. Scenario wording about a team using an unapproved SaaS app, data stored in a service IT never reviewed, or unsanctioned tools adopted by staff points at it, and a CASB plus a sanctioned alternative is the response. The distractors are a rogue device, when hardware is plugged into the network, and an insider threat, which requires intent.