Why do employees keep using shadow IT even when organisations prefer approved tools?

Why This Matters for Security Teams

shadow it is rarely a sign that employees are trying to bypass security for its own sake. More often, it signals a mismatch between approved tooling and the speed, flexibility, or collaboration needs of the business. When sanctioned platforms are too slow to provision, too restrictive to configure, or too hard to integrate, teams gravitate toward whatever unblocks work today. That behaviour becomes a governance problem when data, secrets, and access paths move outside visibility and control.

For security leaders, the key issue is not whether users like policy. It is whether policy creates a workable path that people can follow under real deadlines. The Ultimate Guide to NHIs shows how quickly unmanaged access can accumulate across modern environments, and NIST SP 800-53 Rev 5 Security and Privacy Controls remains a useful baseline for tightening governance around approved systems and access reviews. In practice, many security teams encounter shadow IT only after data has already spread into unsanctioned tools, rather than through intentional workflow design.

How It Works in Practice

Shadow IT usually starts with a local optimisation. A team adopts a file-sharing app, automation service, or collaboration plugin because it removes friction from a specific task. That one decision often expands into informal data flows, unmanaged integrations, and ad hoc credentials. The risk is not limited to the tool itself. It also includes the accounts, tokens, API keys, and third-party permissions created to make the tool useful.

Security teams reduce this behaviour when approved tools are designed around actual work patterns, not only policy ideals. Current guidance suggests three practical moves:

• Shorten the time between request and access so approved tools are faster to obtain than shadow alternatives.
• Provide secure defaults and pre-approved integrations so users do not need to improvise around restrictions.
• Review where teams create workarounds, then fix the control gap instead of treating the workaround as mere noncompliance.

The NHI angle matters because hidden tools often come with hidden identities. The Ultimate Guide to NHIs highlights the scale of unmanaged non-human access in enterprise environments, which becomes harder to govern once teams spread workflows across unsanctioned SaaS apps and scripts. Control baselines such as NIST SP 800-53 Rev 5 Security and Privacy Controls can help, but only if security and IT also make the approved path genuinely usable.

These controls tend to break down in fast-moving hybrid organisations because central approval queues cannot keep up with local delivery timelines.

Common Variations and Edge Cases

Tighter control often increases friction, requiring organisations to balance governance against delivery speed. That tradeoff is especially visible in marketing, product, and engineering teams, where experimentation is constant and the cost of delay is immediate. In those cases, a blanket ban on shadow IT usually pushes usage further underground instead of eliminating it.

Best practice is evolving, but current guidance suggests treating shadow IT as a signal. If a department repeatedly adopts unauthorised tools, the organisation should ask whether approved services are missing key features, lack integrations, or impose approval delays that are out of step with the work. This is also where NHI governance becomes relevant: even a small, user-driven tool choice can create service accounts, tokens, and shared credentials that outlive the project that introduced them.

One important exception is regulated data. Where confidentiality, retention, or residency requirements apply, convenience cannot be the deciding factor. In those cases, organisations should define narrow approved alternatives, document the risk acceptance process, and track exceptions explicitly rather than allowing informal use to continue unchecked. The Ultimate Guide to NHIs is a useful reference for understanding how quickly unmanaged identities proliferate once exceptions become routine.

Related resources from NHI Mgmt Group

• Why do employees keep using unapproved AI tools even when policy forbids them?
• What breaks when organisations keep using end-of-support GRC software without a transition plan?
• What should IAM teams do when employees keep using unsanctioned AI tools?
• What breaks when organisations manage identities and access in disconnected tools and policies?