Shadow IT: the tools nobody approved and everybody uses

Shadow IT is the collection of tools people adopted because they needed something and asking would have taken three weeks. Every organisation has it, the volume is routinely underestimated by an order of magnitude, and the instinct to treat it as a discipline problem reliably makes it worse — because the behaviour is a response to a process, and banning it moves the same activity somewhere less visible.

Why shadow IT appears

• The approved tool does not do the thing, or does it badly enough that people route around it.
• Procurement takes longer than the problem allows, so a free tier solves it on a Tuesday afternoon.
• The need was genuinely temporary — a one-off conversion, a quick survey — and then it stopped being temporary.
• Somebody joined from another company and brought their habits with them.
• A team wanted to try something before committing, which is reasonable and should have a sanctioned path.

What the real risks are

Not usually the ones people list first. The common framing is security breach, but the more frequent damage is quieter: company data sitting in an account tied to one person's personal email, which disappears when they leave; no backup and no export; a free tier that silently caps or deletes; contractual exposure when customer data is processed somewhere your own agreements never mentioned. Data protection is the sharp edge — a tool nobody assessed, processing personal data, in a jurisdiction nobody checked, is a genuine compliance gap regardless of how secure the vendor actually is.

The single most useful discovery method is not a scanner. It is the expenses listing: search card statements for small recurring charges, because the typical shadow tool is paid for personally and claimed back, or sits on one corporate card under somebody's name.

Bringing it into the open

1. Amnesty first — ask what people are using, with a stated promise that the answer is not a disciplinary matter.
2. Sort by what the tool holds rather than by what it costs: customer data outranks a diagramming tool regardless of price.
3. Adopt the good ones properly, with a company account, an owner and a renewal date, rather than reflexively replacing them.
4. Retire the duplicates by agreeing which survives, not by decree — four note-taking tools is a decision somebody has to make.
5. Fix the path that caused it: a lightweight request route with a days-not-weeks answer removes most future shadow adoption.
6. Re-run the discovery annually, because it comes back as soon as the request path slows down.

Ettex Records suits the resulting inventory — tool, owner, what data it holds, renewal date, whether it was assessed — which is also most of what a data protection review asks for. The ongoing cost of the approved ones belongs with the supplier register, since a subscription nobody owns renews indefinitely.