A team member signs up for a file-sharing tool to send a large document. Someone else starts using an AI assistant to draft customer replies. A department buys a project-management app on a company card because the approved process is taking too long.
None of these decisions may feel significant on its own. Together, they create a second technology estate: one the business may not have assessed, secured or even recorded.
This is shadow IT. It is not necessarily the result of careless staff or deliberate rule-breaking. More often, people are trying to get work done with the tools available to them. The strategic question for an SME is not simply how to block those tools. It is how to understand what is being used, why it is useful and whether it belongs in the organisation’s technology strategy.
Shadow IT is bigger than an unfamiliar app
Shadow IT can include software subscriptions, browser extensions, free trials, personal cloud accounts, AI tools, mobile apps and integrations between platforms. It may also involve a legitimate, approved product being used through an unmanaged account or for a purpose that has never been reviewed.
That makes the issue easy to underestimate. A service may not appear in a formal software register, but it could still hold customer information, staff records or commercially sensitive files. It might have access to email, calendars or other business systems through an integration.
The National Cyber Security Centre’s guidance on shadow IT highlights the risk of services sitting outside normal asset management and organisational policy. Its guidance on securing SaaS tools is also relevant to smaller organisations assessing online services.
The right response starts with visibility, not blame. If people are using an unapproved tool, ask what problem it solves. The answer may reveal a genuine gap in the approved process, or an application that is no longer needed.
What can go wrong when an app is invisible?
The risk depends on the application, the data it handles and how it connects to the rest of the business. A low-risk planning tool is different from an unknown service storing payroll data. But even a familiar brand is not automatically safe for every purpose.
Common concerns include:
- Data exposure: Staff may upload confidential or personal information to a service without understanding its sharing settings, retention practices or terms.
- Weak access control: An employee-owned account may not use the organisation’s multi-factor authentication, central sign-in or access policies.
- Unclear ownership: The company may not know who administers the service, who can access its data or how access should be removed when roles change.
- Hidden integrations: An app connected to email, files or customer systems may have broader permissions than its day-to-day use requires.
- Uncertain continuity: A trial, personal account or unsupported subscription may be suspended or abandoned, leaving data difficult to retrieve.
- Unplanned expenditure: Several teams may be paying for overlapping tools, or a free trial may quietly become a recurring subscription.
UK GDPR does not make an unapproved app automatically unlawful. However, organisations need to understand how personal data is handled and put appropriate safeguards in place. The ICO’s accountability and governance guidance is a useful reference for building that oversight.
Discover what the business is actually using
A software list assembled from memory will miss the very tools you are trying to find. A more reliable picture comes from comparing several sources, proportionately and with appropriate transparency.
Useful starting points include:
- Expense claims, company-card transactions and supplier invoices
- Software procurement records, contracts and renewal notices
- Sign-in activity from your identity platform
- Email and collaboration permissions, including third-party integrations
- Endpoint and mobile-device inventories
- Browser or network records, where monitoring is appropriate and communicated
- Short conversations with teams about the tools they rely on
Look beyond paid desktop software. Ask about personal accounts, AI assistants, free trials, browser extensions, automation platforms and apps used on mobile devices. A service might be supported by an employee’s own account even if the company never received an invoice.
Discovery should be carried out in line with relevant privacy and employment requirements. Explain what is being reviewed and why; use monitoring that is proportionate to the business need. The aim is to understand the technology estate, not to create a culture of surveillance.
Give each app a clear decision
Finding an application is the start of the review, not the verdict. For each service, establish:
- Purpose: What task does it support, and who relies on it?
- Ownership: Who is accountable for the business use and administration?
- Information: What data is stored, uploaded, shared or generated?
- Access: Does the app use company-managed accounts and appropriate authentication?
- Connections: What other systems can it access, and are those permissions necessary?
- Supplier terms: Are data handling, support, retention and exit arrangements understood?
- Cost and value: Is the service being used, and is it duplicating another subscription?
The result need not be a long technical assessment for every low-risk tool. A simple, documented decision can be enough: approve it, approve it with conditions, replace it with an existing service, or retire it safely.
For higher-risk applications (particularly those handling sensitive or large volumes of personal information, or supporting a critical business process) take a deeper look. Consider whether further privacy assessment, supplier assurance or specialist advice is appropriate. Record who accepted any remaining risk and when the decision should be reviewed.
Make the approved route easier than going around it
A policy that says “do not use unapproved apps” will have limited effect if it takes weeks to get a sensible tool reviewed. Staff need a straightforward way to ask for a service, explain the need and get an answer.
A practical governance model should set out:
- What information must not be entered into unapproved tools
- Minimum expectations for accounts, authentication and sharing
- Who reviews requests and how quickly
- How exceptions are approved and recorded
- What to do if someone discovers an unapproved app
- How data and accounts are handled when a service is retired
The culture matters. If an employee admits to using a tool, the first response should be to understand the use and contain any immediate risk, not to assume misconduct. Where the app is valuable, assess whether it can be brought under company control or replaced with a suitable approved alternative. If it must be withdrawn, plan for data export, access removal and safe deletion.
Make governance part of the IT strategy
Shadow IT is a governance issue, not just a helpdesk issue. Blocking a website or removing an account may deal with one symptom while leaving the reason for its use untouched.
The Fractal IT Director approach begins with the business context: what teams need to achieve, what information they handle, what risks are acceptable and how technology decisions should be made. From there, an IT consultant can help establish proportionate rules, application ownership and a process for review.
Execution services can support that strategy as bolt-ons. For example, Cloud Solutions can provide a managed environment for approved services; Network Solutions and Helpdesk Support can help implement controls and guide staff towards supported tools. Managed IT Services can assist with monitoring and administration, while Voice and Connectivity can support reliable access to the platforms employees need. These services have value when they serve a defined governance plan, not as a substitute for one.
Technology Expense Management can add another useful view by bringing subscriptions, usage, renewals and costs into one review. The purpose is not simply to cut spend. It is to understand whether each service has an owner, a business purpose and a place in the wider estate.
Keep the picture current
New apps appear faster than annual policy reviews. Set a regular, proportionate review of the application register, with extra checks when a team introduces a new service or an existing tool changes significantly.
Useful measures include the proportion of identified apps with a named owner, the number of unreviewed high-risk services, how many applications use company-managed sign-in and how quickly abandoned access is removed. Reviewing those measures gives directors a clearer view of whether governance is working.
Shadow IT will not disappear because a policy says it should. But it can become visible, understandable and manageable. Start by finding the tools, listening to the people who use them and making clear decisions about what belongs in the business.
For a wider view of Evestaff group services, visit evestaff.co.uk. To discuss a consultancy-led approach to technology governance, contact Evestaff IT Support and Consultancy.
SEO keywords
Cloud Solutions, Disaster Recovery, Dynamics 365 Jump Start, Helpdesk Support, IBM i Management, Managed IT Services, Network Solutions, Technology Expense Management, Voice and Connectivity
Join The Discussion