Shadow IT Best Practices: A Playbook for CISOs, IT Managers, and Executives

Key takeaways

1. Shadow IT isn't going anywhere. Gartner predicts that 75% of employees will acquire, modify, or create technology outside IT's visibility by 2027.
2. Shadow AI is now a major part of the picture, and the UK's NCSC explicitly names AI tools used without permission in its shadow IT guidance.
3. Sanctioned tools are a part of the problem too, with studies showing over a third of all ‘anyone with the link’ files shared via approved platforms contain sensitive data.
4. Your goal should be zero unknown shadow IT, not zero shadow IT. To do that, you need a hands-on playbook tailored to your role: CISO, IT manager, or executive.

Shadow IT defined in 60 seconds

Shadow IT is any technology (apps, devices, AI tools, cloud services) used for work without IT's knowledge or approval.

Because these assets sit outside asset management and corporate IT policy, they can lead to sensitive data exfiltration or the spread of malware (the NCSC's shadow IT guidance covers this in detail).

Shadow IT is not the same as BYOD. With a working BYOD policy, the organization keeps ownership and control – to an extent – of corporate data on the device. With shadow IT, the risk could be anything from zero to critical, and the organization is completely in the dark.

When your teams are working with a mix of professional and personal devices, your goal shouldn’t be zero shadow IT. It's zero unknown shadow IT.

The 5 principles of every good shadow IT framework

Before we get into role-specific tactics for shadow IT management, let’s look at five basic principles that underpin every good framework:

1. Inventory everything, including services: NIST CSF 2.0 recommends maintaining inventories of all software and services, including API services and cloud-based applications, and continuously monitoring for changes.
2. Review for unauthorized software on a schedule: CIS Control 2 aims to ensure only authorized software is installed, and that unauthorized and unmanaged software is found and prevented. It recommends checking at least monthly, then either authorizing the tool or documenting the exception.
3. Remove the reasons people go rogue: The NCSC advises avoiding unnecessary lockdowns, such as blocking external collaboration, and putting an effective, simple request process in place quickly to avoid processes getting in the way.
4. Bring it above board rather than deleting it: The NCSC also recommends processes that bring unsanctioned services under control – such as migrating data into supported platforms – rather than simply deleting it.
5. Never blame staff: If you punish employees, their peers stop disclosing their own workarounds, and you end up with less visibility than before.

Shadow IT best practices for CISOs

It's important that CISOs are aware of the risks associated with shadow IT and take action. The following practices focus on shadow IT governance, shadow IT discovery, and data exposure.

1. Put shadow IT on the risk register, not the helpdesk queue

Treat shadow IT as an enterprise risk. Triage every discovered tool into one of three categories:

1. Adopt: Low risk, high value. Bring it under SSO and contract.
2. Replace: A real need met by a risky tool. Offer a sanctioned equivalent.
3. Retire: Redundant or high risk. Migrate the data out and revoke access.

2. Layer your discovery sources

Effective shadow IT discovery combines:

• CASB/SASE traffic
• Identity provider logs
• OAuth grant audits
• Expense and card data
• Endpoint management
• Workspace sharing audits

The NCSC notes that CASBs that don't break encrypted connections can't identify personal accounts on approved cloud services, and can't show what users are doing inside approved services. Layering is how you cover those blind spots.

3. Follow the data, not just the app

The costliest shadow IT often isn't a rogue tool; it's "shadow data" leaving sanctioned platforms. These external file-sharing risks are easy to miss:

• "Anyone with the link" files
• Documents shared to personal Gmail accounts
• Partner access that outlived the contract

This is permission drift, and it compounds silently. Every file shared "just this once" becomes part of an exposure surface nobody is tracking. We’ll come back to this later.

4. Scope shadow AI from day one

Shadow AI governance shouldn't be a separate project that starts after your shadow IT program matures – because chances are, your teams are already pasting data into unsanctioned AI tools. In fact, the NCSC in September 2026 cited Microsoft research finding that 71% of UK employees had used AI tools their employer hadn't approved.

The sequence that works:

1. Classify sensitive data before you ban anything.
2. Offer an approved AI tool so people have a safe default.
3. Monitor for unsanctioned AI use and move users toward the approved option.

For a deeper look, read our guide to AI data leaks, which includes a 3-step framework for managing AI tool risks.

5. Report in business language

"We found 400 apps" doesn't move a board to act, but "X sensitive files are exposed to Y external domains" does. Frame findings as outcomes: data exposed, partners affected, time to remediate.

Shadow IT best practices for IT managers

IT managers run the process day to day. These tactics answer the practical question of how to prevent shadow IT without becoming the department of "no."

1. Launch a 48-hour fast lane for low-risk tools

Slow approvals are the single biggest driver of employees looking for a quick fix. So, launch a 48-hour fast lane for low-risk tools and pair it with a published catalog of pre-approved apps, so the answer is often "already approved."

2. Run a monthly unauthorized-software review

Following CIS guidance, give every discovered app an owner, a category (adopt, replace, or retire), and a date. Reviews without owners and deadlines turn into spreadsheets nobody reads.

3. Hold a shadow IT amnesty, then migrate

Invite disclosure with no penalty. Then move the data into supported platforms before switching anything off, so work doesn't break, and trust isn't burned.

4. Close the offboarding gap

When employees or partners leave, be sure to revoke:

• OAuth grants
• External shares
• Guest accounts

Stale partner access is shadow IT hiding inside tools you already pay for.

5. Distribute ownership of data sharing

IT can't review thousands of shared files alone. Let file owners confirm or revoke their own external shares with a single click, and only escalate the edge cases. This scales in a way central review never will.

6. Make the approved tool genuinely better

If the sanctioned path is worse than the workaround, people will route around it. A 25MB upload cap is a fast track to someone emailing files through a personal account. Treat the approved experience as a product, and fix what frustrates users.

7. Recruit security champions

Name a champion in each department to relay unmet tool needs back to IT before workarounds appear. This gives a face to the issue.

Learn more: ChatGPT Risks in 2026: How IT Teams Can Help Employees Stay Secure

Shadow IT best practices for executives, boards, and procurement

Leaders set the conditions that make shadow IT grow or shrink. Procurement teams are especially well placed to help: expense and card data is one of the biggest discovery layers, and renewal and contract conversations are where adopt-or-retire decisions become real.

1. Don’t just ban everything – fund the alternatives

Goldman Sachs, for example, restricted ChatGPT in 2023 and later rolled out its own AI assistant to staff. Pairing a block with a safe alternative is what stops a ban from pushing usage underground.

2. Know the regulatory stakes

In 2022, 16 Wall Street firms agreed to pay combined penalties of more than $1.1 billion for failing to preserve records of electronic communications. Employees had routinely discussed business over text messaging apps on personal devices, creating huge liability for their companies.

3. Lead by example

Employee habits start with supervisors and senior executives. Shadow IT is a leadership habit as much as a staff one, so you can set the tone by showing your teams what safe habits look like in practice.

4. Ask three key questions every quarter

1. What share of our apps are sanctioned?
2. How much sensitive data is shared externally, and with whom?
3. How long does a tool request take to approve?

5. Back a "coach, not cop" culture

In our experience, the strictest IT department probably has the most shadow IT. Keep communication between employees and IT open, so there isn’t a culture of secrecy. This way IT knows well in advance if an unsanctioned tool is in play.

So, those are our three hands-on playbooks for CISOs, IT managers, and executives to take control of shadow IT. But how do you know you’re moving the needle?

Metrics that prove your shadow IT program is working

Track these six metrics to measure whether your playbook is working:

1. Ratio of known to discovered apps: Tracked over time and reported.
2. Mean time to approve a tool request: Target under 48 hours for low-risk tools.
3. Sensitive files shared externally: Follow monthly and quarterly trends.
4. Stale external shares and partner access remediated: Aim for a rising percentage.
5. Amnesty and self-reported disclosures: Rising disclosures signal a healthy culture.
6. Unsanctioned vs. sanctioned AI tools: Unsanctioned tools can point to a problem.

Speaking of helpful metrics, have you seen our free guide to 12 Essential Cybersecurity Metrics?

The blind spot most shadow IT programs miss: your sanctioned apps

Most programs hunt for unknown apps, but the biggest exposure often comes from somewhere less suspicious: sanctioned apps and tools. A rising share of real exposure happens inside tools IT has already approved, like Google Drive, SharePoint, and OneDrive.

For example, a 2025 study found that over a third of all files shared to ‘anyone with the link’ using approved platforms contained sensitive data – even including protected health information. If left unchecked, this could open an organization to all kinds of regulatory headaches, and a loss of customer trust.

There are three ways this can happen:

1. Wrong shares: Files shared with the wrong partner(s)
2. Public shares: Links left open to anyone
3. Forgotten shares: Access nobody remembers granting

Network-based discovery often can't see this – and this is where DLP (Data Loss Prevention) earns its place in a shadow IT program. Traditional DLP focuses on blocking data at the perimeter – but modern shadow IT governance needs DLP that audits how data is actually shared inside your sanctioned collaboration platforms.

We built Sonar, a DLP solution that audits the data shared through your Google or Microsoft workspace to help you spot and fix mistakes or abuses:

• Partner-aware: data privileges vary per partner, and Sonar's policies reflect that.
• Distributed ownership: Sonar's AI assistant, Albert, explains good sharing practices to employees, so they fix their own shares while you focus on policy and edge cases.
• Quick setup: Google and Microsoft integrations can be completed in just a few clicks.

Your 90-day shadow IT action plan: see, simplify, solve

As we outlined in our introductory guide to shadow IT, here’s a 90-day action plan to take control and get visibility on what’s happening within your organization:

Days 1 to 30: See it – get some visibility

• Establish a discovery baseline
• Audit OAuth grants
• Audit external file sharing in Google Workspace and Microsoft 365
• Announce the amnesty

Days 31 to 60: Simplify it – fix the process and the policy

• Launch the fast lane and the pre-approved catalog
• Update the acceptable use policy with AI and personal device guidance
• Migrate the top five shadow tools

Days 61 to 90: Solve it – build a culture where IT is a partner, not a gatekeeper

• Roll out awareness training
• Distribute sharing ownership to employees
• Present the metrics to leadership
• Set a quarterly review cadence

Take control of shadow IT for good with our best practices

Shadow IT is a signal that approved tools and processes aren't delivering what your teams really need. The organizations that win make the approved path the fastest one, see where their data actually goes, and coach rather than police.

Your goal should be zero unknown shadow IT. To find out how Riot can help, chat to one of our experts today.

FAQ

1. What are the most important shadow IT best practices? Continuous discovery, a fast approval process, sanctioned alternatives, a no-blame culture, and visibility into how data is shared.
2. Who should own shadow IT? The CISO owns the risk, IT owns the process, and executives fund the alternatives. Employees share responsibility for their own data sharing.
3. How often should we audit for shadow IT? Monthly for unauthorized software (per CIS), with a quarterly policy and external-sharing review.
4. Should we block shadow IT outright? No. Blanket bans push usage underground. Triage it into three categories: adopt, replace, or retire.
5. Is shadow AI part of shadow IT? Yes. The NCSC now names it explicitly.
6. How does DLP help? It shows where sensitive data actually goes, including through sanctioned apps.