Shadow IT

We like shadow things.

Shadow IT was 10 years ago when cloud came out and it was like, oh, everybody's bringing apps to work.

People are bringing their own kind of GPT models to work.

That's one third, in fact.

And it didn't start with AI.

It started with cloud and groups still doing shadow IT and data and still doing shadow data, right? AI is just a new frontier of that kind of technology.

And those shadow organizations.

So part of it is bringing together the organization, having that trust built centrally so that all of the lines of business inside of these large enterprises can leverage and accelerate based on that centralized technology.

Fantastic.

I'm sure that a lot of executives at the event today will have questions related to the presentation.

It's interesting how Paul connects the need for responsive IT services with preventing shadow IT.

It really highlights the balance between governance and flexibility.

They move work to a tool you don't manage.

That's Shadow IT.

And you built it yourself.

One blocked file at a time.

Inventory every AI tool in use across your company, including those free personal ones people use on their phones or laptops.

Shadow IT is a huge problem here.

Massive.

You must mandate that work tasks only occur on company-approved accounts with logging enabled.

Makes a lot of sense now.

So Chance, what's the difference between shadow IT and shadow AI? And why is AI different in kind, not just in degree from previous technology waves?

So in order to answer this question, I think it's important to understand what shadow A, excuse me, what shadow IT is.

shadow it is that that concept that within most organizations it owns all software all hardware all applications they're responsible for the the process at which you acquire implement and maintain these applications what happened as we had the um kind of the SaaS revolution, software as a service, What happened is the marketing team decided that they wanted this marketing software, but going through IT had this bureaucratic process that would take them six months to get this approved.

And the SaaS company said, come on over, bring your credit card.

We'll let you sign up.

Give them a credit card, buy the product, start using it.

IT finds out six months from now, and then there's a conversation between leadership, and then eventually they take it over and start managing it.

It's also an opportunity to rethink how teams are structured and how responsibilities are distributed, ensuring that AI expertise is embedded across the security function.

Meanwhile, the proliferation of unsanctioned AI tools, often referred to as shadow IT, is creating new vectors for data leakage, compliance violations, and operational risk.

These tools are often adopted by business units or individual employees without formal approval or oversight, making it difficult for security teams to maintain visibility and control.

Addressing this requires more than just technical solutions.

It's not just about having enough people.

It's about having the right expertise to manage increasingly complex and AI-driven environments.

Fourth, the expansion of shadow IT and unsanctioned AI tools is complicating risk management efforts.

The attack surface is growing, and traditional controls are often insufficient to address the risks posed by unauthorized technology adoption.

Yeah, yeah, I think another great question.

So if you think about You know, we used to have, what, Shadow IT, now, of course, the Shadow AI.

You know, there used to be, when the cloud was coming up, People would go and just open up an AWS account on their credit card and they'd go run some workloads and do some other stuff.

You know, IT couldn't really get a handle on that.