Shadow IT: The Hidden Risks of Unauthorised Software and AI Tools

Shadow IT: The Hidden Risks of Unauthorised Software and AI Tools

Your employees use more software than you think. Research shows that the average SME has 3-5x more applications in use than IT is aware of. From free file-sharing tools to AI chatbots where trade secrets get typed in: shadow IT is growing explosively and brings risks you can't secure if you don't know they exist. In this article you'll find out what shadow IT is, why it's a bigger problem in 2026 than ever before and how to bring it under control without holding back innovation.

Key takeaways (TL;DR)

• 80% of employees use software that hasn't been approved by IT. That's shadow IT.
• The average organisation uses 3-5x more applications than IT has in view.
• AI tools are the new shadow IT hotspot: 65% of employees who use AI do so without IT's permission.
• Shadow IT increases the risk of data breaches because business data is processed outside the secured environment.
• NIS2 and the GDPR hold organisations liable for data leaked through shadow IT, even if IT didn't know about it.
• A ban doesn't work: the solution lies in policy, approved alternatives and awareness.
• Visibility is the first step: you can't secure what you can't see.

What Is Shadow IT?

Shadow IT covers all hardware, software and cloud services that employees use without the approval or knowledge of the IT department or IT partner. These are tools that fall outside the official IT policy and are therefore not managed, monitored or secured.

Examples of shadow IT you'll find in almost every business:

• File sharing: WeTransfer, Dropbox or Google Drive alongside the official Microsoft 365 environment
• Communication: WhatsApp groups for work-related conversations instead of Teams
• AI tools: ChatGPT, Gemini or other AI tools into which business data is entered
• Project management: Trello, Notion or Asana alongside the official project tools
• Personal devices: private laptops and phones without endpoint management

Why Shadow IT Is Bigger Than Ever in 2026

Shadow IT isn't new, but three factors make it a greater risk in 2026 than ever before.

The AI explosion

The rise of AI tools has created a new wave of shadow IT. Employees are discovering that ChatGPT, Claude, Gemini and other AI tools make their work faster and easier. They start using them without thinking about the data risks.

The problem: free AI tools process everything you enter. Business plans, customer data, financial data, HR information: it all disappears into models where you don't know who has access.

SaaS sprawl

The range of free and freemium SaaS tools is unprecedented. For every task there are dozens of tools employees can sign up for and start using within minutes. No installation needed, no IT approval requested.

The convenience of the cloud

Everything runs in the browser. Employees don't need to install anything on their computers, so traditional software controls don't work. An employee opens a browser tab, logs in with a personal account and gets to work.

The 5 Biggest Risks of Shadow IT

1. Data loss and data breaches

The biggest risk of shadow IT is uncontrolled data flows. When business data is stored in tools that IT doesn't manage, you lose control over who has access, where the data is stored and whether there are adequate backups.

A real-world example: an employee uploads a customer list to a free cloud tool to create a mailing. That tool gets hacked. The business has a data breach without knowing it, until customers start complaining about spam.

2. Compliance violations

The GDPR sets clear requirements for processing personal data. You need to know where data is stored, who has access to it and whether there's a data processing agreement in place. With shadow IT, the answer to all these questions is: "no idea".

With the arrival of NIS2, the requirements are getting even stricter. Organisations must be able to demonstrate control over their IT environment, including the tools their employees use.

3. Security gaps

Shadow IT tools aren't covered by the organisation's security policy. They sit outside the firewall, have no MFA, aren't monitored and don't receive patches through the management platform.

Every unauthorised tool is a potential entry point for attackers. An account on a free tool with the same password as the business account: that's an attack vector security tools can't see.

4. Integration and collaboration problems

When teams use different tools, data silos emerge. Information is scattered across platforms that don't talk to each other. The efficiency gains employees are looking for vanish in the chaos of fragmented workflows.

5. Higher costs

Shadow IT costs money. Duplicate licences, inefficient use of existing tools and the cost of cleaning up when things go wrong. On top of that, you pay indirectly for missed consolidation benefits: if half the company uses Dropbox alongside OneDrive, you're paying twice.

AI as Shadow IT: The New Risk

AI deserves special attention as a shadow IT risk. Where traditional shadow IT was mainly about storage and communication, AI goes to the heart of your business information.

What employees do with AI tools:

• Enter customer questions to generate answers
• Have financial reports analysed
• Have HR documents rewritten
• Have strategic plans reviewed
• Have code written with business data as context

Why this is problematic:

• Free AI tools may use the data you enter for model training
• Data may be stored on servers outside the EU
• There's no data processing agreement
• You have no control over who has access to the output
• The AI Act imposes additional requirements on AI use

The solution isn't a ban on AI, because that doesn't work and holds back innovation. The solution is to offer approved AI tools with enterprise-grade security, such as Microsoft 365 Copilot.

How Do You Tackle Shadow IT?

An effective approach to shadow IT combines policy, technology and culture. Here's a practical step-by-step plan.

Step 1: Map it out

You can't secure what you don't know about. Carry out an inventory of all the software used in the organisation.

How:

• Analyse network traffic for unknown cloud services
• Run an anonymous employee survey
• Check browser extensions and installed applications using MDM tooling
• Review credit card statements for SaaS subscriptions

Expect surprises. In most inventories, the number of tools turns out to be 3-5x higher than expected.

Step 2: Assess and categorise

Not all shadow IT is bad. Some tools genuinely add value. Assess every tool you find on:

• Security: does the tool meet your security standards?
• Compliance: is there a data processing agreement? Is data stored in the EU?
• Overlap: is there already an approved tool with the same functionality?
• Value: does the tool solve a real problem?

Categorise each one as: approve, replace with an approved alternative, or block.

Step 3: Offer approved alternatives

The main reason employees use shadow IT is that the official tools don't meet their needs. Solve that problem.

• Employees using WeTransfer? Make sure OneDrive sharing is easy to use.
• Employees using free ChatGPT? Offer Copilot or an enterprise AI tool.
• Employees using WhatsApp for work? Make Teams the standard, with a good mobile experience.

Step 4: Set clear policy

Create an Acceptable Use Policy that clearly describes:

• Which tools are approved for which purposes
• How new tools are requested and assessed
• Which data may and may not be entered into external tools
• What the consequences are of ignoring the policy

Keep it short, practical and easy to understand. Nobody reads a 50-page policy document.

Step 5: Train and communicate

Employees rarely use shadow IT with bad intentions. They want to do their job well and look for the most efficient way to do it. Make them aware of the risks without blaming them.

Good security awareness training explicitly covers shadow IT, its risks and the approved alternatives.

Step 6: Monitor continuously

Shadow IT isn't a one-off project. New tools appear every day and employees will keep looking for better solutions. Put continuous monitoring in place and periodically assess whether your tool landscape still meets people's needs.

Striking the Balance: Security versus Innovation

The biggest pitfall in tackling shadow IT is going too far and imposing a blanket ban. If you block everything, you frustrate employees and hold back innovation. They'll look for workarounds that are even harder to detect.

The right balance means:

• Being open to new tools and technologies
• Fast assessment processes so good tools get approved quickly
• Clear frameworks within which employees can make their own choices
• Transparent communication about why certain tools are or aren't allowed

The goal isn't to stop innovation, but to channel it safely.

Frequently Asked Questions

Is shadow IT always bad?

No. Shadow IT is often a sign that the official tools fall short. It shows that employees are proactively looking for solutions. The risk doesn't lie in the drive to innovate, but in the lack of visibility and security. The answer isn't to ban it but to manage it.

How do I find out which shadow IT is being used in my business?

The most effective method combines network analysis, an anonymous employee survey and a review of your endpoint management tools. Network analysis shows which cloud services are being accessed; the survey uncovers tools used on personal devices.

Am I allowed, as an employer, to monitor employees' internet traffic?

Yes, provided you communicate this in advance and set it out in your privacy policy. You may monitor business internet traffic for threats and policy violations, but you must be transparent about what you monitor and why. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) sets clear boundaries.

How do I stop AI tools being used as shadow IT?

By offering approved AI tools that meet your security requirements. Enterprise versions of tools such as Microsoft Copilot or ChatGPT Enterprise offer data isolation and compliance guarantees. Combine this with a clear policy on what may and may not be entered into AI tools.

What does it cost to tackle shadow IT?

The inventory and policy-making take 2-4 working days. Ongoing monitoring can be integrated into your existing managed IT service. The investment is minimal compared with the risk of a data breach through an unmanaged tool.

How does shadow IT relate to hybrid working?

Hybrid working increases the shadow IT risk because employees work outside the office network and find it easier to use their own tools. The approach is the same: visibility, policy, approved alternatives and awareness. Endpoint management and cloud-based security are essential here.

Get a Grip on Shadow IT

Shadow IT doesn't go away if you ignore it. It grows. And with the explosion of AI tools, it's only getting bigger. The organisations that succeed aren't the ones that ban everything, but the ones that bring it under control.

At TRON Group we help SMEs map and manage shadow IT. From inventory to policy, from endpoint management to monitoring. We make sure your team can work productively with the right tools, within secure boundaries.

Want to know how much shadow IT is lurking in your organisation? Get in touch for a no-obligation conversation or call us directly on +31 85 303 5869. Together we'll map it out and bring it under control.