The discovery landed badly. During a routine review of company card spending, we found that the marketing team had been paying for a file-sharing service, a scheduling tool and a small database product, none of which had passed through IT, none of which had been reviewed by security, and all of which held real company data. The initial reaction in our department was exactly what you would expect, a mixture of indignation and the urge to send a firmly worded reminder about policy. That reaction, I have come to believe, is the single least useful response available.
Because when you actually asked marketing why, the answer was not defiance. They had requested something similar from us fourteen months earlier, been told it would need a review, heard nothing for a quarter, and then found something that worked for forty euros a month. They were not trying to bypass governance. They were trying to do their jobs, and we had been, from their perspective, an obstacle with a ticket queue. Every unauthorised tool in that spreadsheet was a small, precise report on where our service had failed to show up.
That is what makes shadow IT such valuable data, if you can get past the initial affront. It marks the exact places where the official path was slower than the need, and it does so with real money and real urgency behind it, which is more honest than any internal survey we could have run. People do not pay for a workaround out of principle. They pay because the sanctioned route did not arrive in a timeframe that matched their problem.
The risks are genuine and I do not want to minimise them, because company data in an unreviewed tool is a real exposure. But the durable fix is not a stricter prohibition, which mostly teaches people to hide it better and pay in ways that never touch a company card. It is to shorten the distance between someone needing a capability and getting a safe version of it, and to treat every discovered tool as a request we failed to answer in time.
If your users are routing around you, that is not an obedience problem. That is a review of your service, filed in the only language they had left.
– Serguey Shinder
Top comments (0)