Security Awareness Briefing  //  Eriu Technology  //  Defensive Use Only

SHADOW
IT

The tools you don't know you're using.

Every app a staff member signs up for holds a piece of your business — here's how to see the ones you can't.

01 / What it is

Shadow IT is any app, tool or service used for work without IT's knowledge or approval. It's usually well-intentioned, and that's the trouble: your data ends up in places you can't secure, monitor, or even list.

02 / How it works
1
A staff member hits a limit and signs up for a quick tool.
2
They feed it real data to get the job done.
3
The account — and your data — sit outside your control.
4
A breach or a leaver turns it into an exposure you can't see.

→ You can't protect what you can't see — and you can't even tell a regulator what was lost.

Where it hides

It gathers in the everyday:

File-sharingPersonal cloud drives for work files.
Free SaaS trialsSigned up, never decommissioned.
Automation toolsWired into your real systems.
AI chatbotsCompany data pasted in to 'help'.
!
Make the right way the easy wayPeople reach for shadow tools when the approved ones are painful. Give them good, sanctioned options and a quick way to request new ones — then nobody needs to go around you. Punishing it just drives it further underground.
03 / Why it's dangerous
  • You can't secure what you can't see — or list after a breach.
  • Data scatters across unvetted third parties.
  • Leavers keep access to tools IT never knew about.
  • AI tools can swallow confidential data in a single paste.
04 / How you stop it
  • Offer good sanctioned tools so the detour isn't tempting.
  • Make requests easy — a fast yes beats a quiet workaround.
  • Discover what's in use — expense reports and login logs tell a lot.
  • Set a clear AI-use policy on what can and can't be pasted in.
  • Review and retire unused accounts regularly.
Tools unseen · Data everywhere
An Eriu Technology security briefing  ·  Awareness & defence only