What is shadow IT and why is it a risk?
Shadow IT, Software that employees use without IT approval, is bigger and riskier than most organisations realise. What it is, how it arises, and how to tackle it.
- August 25, 2026
- 5 min
Shadow IT is one of the biggest blind spots in Software management at Enterprise organizations. It refers to all technology that employees use without approval from IT or purchasing: apps, cloud storage, and communication tools. And it’s larger than most organizations realize.
How does shadow IT arise?
Almost always from a real problem. An employee needs a tool, approval takes too long, or the IT alternative is inconvenient. The shortest route is a free account or a small subscription on the corporate credit card.
What starts with one person grows quickly. Colleagues join in, files are shared via unapproved platforms, and sensitive company data ends up with parties with whom no agreements exist.
Why is shadow IT a problem?
1. Security risks. Unapproved tools are not assessed, not updated, and not monitored.
2. Compliance risks. Data processed via these tools falls outside your control, while your organization remains responsible under the GDPR.
3. Waste. You pay for central tools while employees also use other tools that do the same.
Shadow IT and the Cybersecurity Act
Since 15 August 2026, the Cybersecurity Act applies in the Netherlands, implementing NIS2. Organizations subject to it must manage the risks in their supply chain, including their ICT suppliers. Shadow IT makes that overview inherently incomplete.
How to tackle shadow IT?
Don’t start by banning, but by understanding. Why do employees use certain tools and what is missing in the approved offering? Analyze credit card statements, expense claims, and invoices for unknown subscriptions, ask employees which tools they use, and consolidate findings with IT and purchasing.
Also watch for the newest variant: departments purchasing AI tools themselves. Read more about this in our article Shadow AI: the new shadow IT.
How SoftVaro helps
SoftVaro maps your complete Software landscape, including tools acquired outside of IT. Then we help you consolidate towards Software with good commercial terms.
Frequently Asked Questions
The most asked questions about this topic.
What exactly is shadow IT?
Shadow IT is all Software and technology that employees use without approval or knowledge of IT or purchasing, such as free tools, personal cloud storage, or unapproved communication platforms.
How do you discover which shadow IT exists in your organisation?
Start with credit card statements, expense reports, and invoices. Then ask employees which tools they use and supplement that with data from your IT management or SAM tooling.
Does shadow IT have consequences under the Cybersecurity Act?
The Cybersecurity Act obliges organisations that fall under it to manage the risks in their supply chain. Software purchased outside IT is included in that scope.
Ready to save on software?
SoftVaro negotiates the best deal on your behalf with over 4,000 suppliers. Independent, transparent, within 24 hours.