Shadow IT – Reasons, Risks and Remediation
Shadow IT covers far more than apps installed without authorization or PCs and routers brought in from home. This talk discusses how uncontrolled IT also stays hidden in devices, cloud services and supply chains. Causes include hard-to-use corporate systems, time pressure, insufficient resources, pressure to outsource services, as well as user creativity and a lack of discipline among privileged power users and administrators. This creates potential risks from unpatched systems to data leakage, compliance violations, unknown dependencies and unclear responsibilities. As complexity, regulation and misuse increase, training and policies alone are not enough. What is needed: up-to-date inventories, limited privileges, adequate supplier due diligence, ongoing monitoring, automated pattern detection, rapid response, sufficient evidence of due-diligence compliance, realistic fallback plans, and a new understanding of trust.
AI Summary
Disclaimer: This session information was generated with the help of AI.
The information has been reviewed and refined by the Swiss Cyber Storm team before publishing.
Drawing on 40 years in information security, Hannes Lubich argues that there are four types of shadow IT: user-installed shadow IT, IT physically hidden inside devices, non-local IT consumed as a service, and supply-chain IT beyond the first supplier. Governance weakens and the delegated trust grows as each moves further from the organization’s control, while perceived productivity gains keep users adopting them. Since training and regulation never reach everyone, he urges defenders to cover every hiding place with automated detection, evidence collection, a tested plan B and a rethinking of trust.
Video chapters
0:00Introduction and security issues that persist2:58Surface IT and four hidden IT types5:53Force fields of governance, benefit and cost8:20Shadow IT risks and remediation10:35Physically hidden IT inside devices12:10Non-local IT services and SaaS sprawl14:31Losing control along the supply chain16:01Lessons learned on coverage and overloaded IT17:40Life lessons on users, administrators and training22:13Outlook and proposed solutions25:06Q&A: AI-built shadow IT and human oversight
Key facts
- A statistic presented in the talk states that 50% of Software as a Service (SaaS) licenses go unused for 90 or more days, leaving both running costs and open doors for misuse.
- According to the speaker, the number of SaaS applications observed passing through company firewalls is falling because AI front ends now broker access to many underlying services.
- Beyond the third to fifth level of a supply chain, organizations typically have only self-declarations or email confirmations, as auditing every supplier is technically impossible and many suppliers refuse customer audits.
- The speaker reports that a security company, where he sits on the board, is quadrupling its local AI hardware to run its own model so that its data is not placed in any external model.
Ideas
- Shadow IT spans four categories: classic shadow IT on premises, IT physically embedded in devices such as TVs, cars or medical equipment, network-delivered services bought on a credit card, and supply-chain IT beyond the first contracted supplier.
- Two force fields shape hidden IT: governance and control fail while the cost and trust to be delegated rise as IT moves off premises, whereas users' perceived productivity benefit and vendors' promises of lower cost of ownership pull adoption as well.
- Physically hidden IT often carries vendor backdoor access and cannot be touched because of certification constraints, so it has to be ring-fenced with safeguards that look both inwards and outwards.
- Blocking non-local IT services outright quickly makes an organization dysfunctional; the realistic option is to allow them under controls, because individual subscriptions bypass legal, compliance and business-continuity oversight.
- Generative AI acting as a unifying front end hides the services behind it, and non-IT staff building their own tools on sanctioned AI create a new layer of shadow IT that the speaker considers close to impossible to stop at present.
Keywords
- shadow IT
- hidden IT
- supply chain
- SBOM
- governance
- SaaS
- embedded device
Quotes
- “Some of our IT security issues behave like Bruce Willis in one of these Die Hard movies. They just refuse to die.”
- “Life lesson number one, never ever underestimate the creativity of users. Never.”
Recommendations
- Establish a security baseline that covers all four kinds of hidden IT, combining up-to-date inventories, central procurement, balanced access restrictions and active searches for network and physical traces of unknown devices.
- Do not rely on awareness training or regulation alone: assume defenses will be breached, invest in near-real-time automated detection and evidence collection, and maintain a tested, realistic plan B for core processes.
- Look beyond the first supplier by requesting artifacts such as a software bill of materials (SBOM), while recognizing that such evidence becomes fuzzier and more volatile further down the chain.
