Systems, tools and subscriptions adopted by teams without the knowledge or approval of the IT function. Part governance problem, part unfiltered evidence of what the official systems fail to provide.
Every organisation has two technology estates: the one on the architecture diagram and the one people actually use to get work done. Decisions made against the first estate keep being surprised by the second.
Last reviewed 3 July 2026 · Free and ungated
Before a migration or security commitment, selected senior operators can challenge whether the scope reflects how the organisation actually works.
Pressure-test this decisionShadow IT covers technology in use without IT governance: departmental SaaS subscriptions on a company card, spreadsheets that have become de facto systems of record, personal messaging tools carrying client data, automations built by whoever knew how. Cloud pricing made it trivial to acquire; expense thresholds keep it invisible.
Any decision scoped against the official estate inherits the gap. Migrations discover mid-flight that a "simple" legacy system feeds forty unofficial spreadsheets, each now a stakeholder. Security assessments certify a perimeter the actual data left long ago. Software selections evaluate requirements drawn from the official process while the real workflow, the one users built for themselves, goes unexamined, which is one reason new platforms meet such puzzling resistance. Sizing the shadow estate belongs in the preparation for all three.
Treating shadow IT purely as a discipline problem misses what it is: evidence, gathered at the users' own expense, about where the sanctioned tools fail them. Crackdowns push the same behaviour onto personal devices and private accounts, where the risk is worse and the visibility is zero. Organisations that periodically inventory it without punishment learn where demand is unmet. The alternative is learning at audit, breach or migration.