Topic starter
12/06/2026 9:00 pm
TL;DR: Shadow IT is software or hardware operating outside IT’s awareness, and Zluri cites Verizon research showing that 61% of software and hardware on company networks can fall into this category. The governance issue is not just discovery, but deciding what to allow, secure, and audit before unsanctioned tools become compliance and data exposure problems.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “Understanding 'Shadow IT' and its Risks – Quick Intro”.
By the numbers:
- Verizon's study has shown that 61% of all software and hardware on a company's network is considered Shadow IT.
Key questions
Q: How should security teams discover and govern Shadow IT in external attack surfaces?
A: Security teams should treat Shadow IT discovery as a continuous exposure management problem, not a one-time inventory exercise.
Q: Why does shadow IT increase compliance and audit risk in regulated environments?
A: Shadow IT increases compliance risk because unapproved tools often sit outside formal controls for logging, retention, access review, and data handling.
Q: What breaks when employees use unsanctioned apps for work data?
A: The organisation loses reliable control over who can access the tool, what data it contains, and whether security updates or audits are being handled.
Practitioner guidance
- Establish continuous Shadow IT discovery Use discovery processes to identify unsanctioned applications and devices before they accumulate sensitive data or become embedded in daily workflows.
- Classify tools by business value and data risk Separate acceptable productivity tools from high-risk or prohibited ones, then document the data types and access conditions allowed for each class.
- Require approval before sensitive data is stored Put a control gate in place so new SaaS apps, hardware, or personal-use tools cannot become a data repository until they have been reviewed.
Bottom line: Shadow IT is risky because it removes software and hardware from the identity and governance controls that depend on a complete inventory.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
12/06/2026 10:47 pm
Shadow IT is an identity governance problem before it is a software sprawl problem. If IT cannot discover an application or device, it cannot certify access, assign accountability, or prove control over the data flowing through it. That makes the real issue incomplete governance coverage, not just unmanaged technology. Practitioners should treat discovery and approval as part of the identity surface, not as a separate inventory exercise.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: Should organisations block all Shadow IT or govern it selectively?
A: Selective governance is usually more realistic. Some tools support legitimate productivity and can be allowed with controls, while others should be blocked or tightly restricted. The decision should be based on business value, data sensitivity, and the ability to maintain oversight, not on a simple yes-or-no rule.
👉 Read our full editorial: Shadow IT creates visibility gaps that widen identity risk
This post was modified 6 days ago by NHI Mgmt Group