Shadow IT is everywhere. What began with employees or departments bringing familiar tools such as personal email or file-sharing apps into the workplace has grown into unauthorized software-as-a-service (SaaS) platforms, mobile apps, and artificial intelligence (AI). With just a few clicks, these tools become part of daily workflows. But they also create significant operational risk.
In simple terms, Shadow IT is any software, hardware, or resource introduced on a network without approval through official IT, procurement, or compliance processes. This includes personal cloud storage, client-run applications, unofficial chat tools, unapproved unified-communications-as-a-service (UCaaS) solutions, or bring-your-own-device (BYOD) practices. It can also stem from rapid technology changes, overlooked systems, technical debt, or business teams developing apps and portals outside formal oversight.
Research shows that up to 80% of employees adopt Shadow IT because they believe preferred software helps them work more efficiently than sanctioned resources. Now that same pattern is emerging in a new form: Shadow AI—the use of unsanctioned generative AI (GenAI) tools for writing, analysis, and automation that further expand the attack surface and reduce visibility.
The high cost of casting shadows
Data breaches involving Shadow AI cost an average of $670,000 more than other security incidents, according to IBM’s 2025 “Cost of a Data Breach Report,” which also found that 20% of all breaches stemmed from unauthorized AI use. These risks, including regulatory penalties and loss of intellectual property, play out differently across industries.
| Industry | Examples of Shadow IT and Shadow AI |
| Healthcare | Consumer messaging, unapproved storage of medical imaging files, certificate challenges due to specialized portals for specific healthcare groups, department-run electronic health record (EHR) environments, unapproved telehealth platforms, AI for note summarization |
| Insurance | Custom applications for new insurance policy introductions, certificate challenges, maintenance issues, unsanctioned SaaS for claims processing, ad hoc analytics tools, unmonitored cloud data transfers |
| Banking | Personal messaging with clients, unapproved SaaS analytics, AI-driven models outside oversight, unapproved fintech integrations |
| Airlines | Ticketing applications, loyalty/rewards applications, GenAI-based rebooking systems, customer service chatbots, mobile staff communication apps (such as WhatsApp, Signal, or WeChat) |
| Utilities | Contractor remote access, cloud-based desktop-as-a-service (DaaS), AI predictive maintenance applications, unsanctioned Internet of Things (IoT) devices |
The dark side of shadow systems
Shadow IT is really about consequences. Compliance and privacy are among the most pressing. Regulations such as the Health Insurance Portability and Accountability Act (HIPAA), the Sarbanes-Oxley Act (SOX), the General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA) require strict oversight of sensitive data. Unapproved applications may bypass these safeguards, exposing organizations to fines or legal action even if no data breach occurs. Security is another concern. Assets outside IT oversight go unmonitored, leaving vulnerabilities and misconfigurations open to attack. Independent research shows just how big the problem is.
IDC’s “Future of Digital Infrastructure: The Future of Digital Infrastructure, 2024: AI-Ready Platforms, Operating Models, and Governance” found that more than 40% of SaaS applications operate without formal IT approval, creating blind spots that directly undermine compliance requirements. Similarly, the IEEE Computer Society reported that 41% of employees already acquire or build technology outside IT’s knowledge, with that share projected to rise to 75% by 2027.
Unauthorized systems rarely integrate well with official tools, creating silos, duplicate data, and broken workflows. With SaaS and AI adoption accelerating, these risks are spreading faster than IT teams can manage. Eliminating Shadow IT and its cousin Shadow AI isn’t realistic, so the focus must shift from prevention to smarter control.
Exposing what’s outside IT’s view
Regaining control begins with visibility. Teams need to see what’s moving across the network, including live activity, unauthorized apps, and new risks. By analyzing network traffic in real time, NETSCOUT gives IT and security teams the insight to uncover Shadow IT and Shadow AI, close compliance gaps early, and keep sensitive data out of unapproved systems, bringing a hidden problem into the light.
See how NETSCOUT, together with partners such as Splunk, helps organizations turn Shadow IT into actionable intelligence. Download our solution brief for examples of how we help industries stay ahead of compliance, security, and performance risks.
