Attention IT Departments: Is Your Business Going Behind Your Back with “Shadow IT Maneuvers?

Aug 28, 2012 | Cloud, Fresh Ink, Inside the Briefcase, Top Stories

Sales, management and other business departments have always had a mind of their own (as have, admittedly, IT departments). Lately, more and more departments are going behind IT’s back to implement technical solutions “on their own” (sort of).

As you might guess, these solutions typically involve cloud computing. While the cloud is great for VPN and usage spikes, it can be a mixed blessing when it comes to enterprise sales, HR and management solutions.

Shadow IT describes a situation when a department implements a technical solution without going through (or even alerting) the IT department. While this phenomenon is nothing new, it has changed faces over the years.

These days, Shadow IT usually involves sales or management signing up for a cloud solution, generally as a way to interact with customers and clients. By the time the real IT department finds out about it, data has been severely fragmented, security has been put at risk or even breached, and boundaries that were there for good reasons have been blurred.

Where Shadow IT Starts

One of the biggest reasons that other parts of an enterprise go around the information technology department is because of time considerations. Non-IT personnel often don’t understand amount of time it takes to integrate a fully functional and secure solution and that lack of knowledge leads to frustration, which leads to the dark side.

Nowadays, cloud computing services offer everything from mobile office and file systems to client interaction interfaces to data analysis for marketing and sales departments. These solutions are specifically tailored for ease of use by non-technical clients.

Look at it from the non-technical manager’s point of view: The kind of solutions that were out of their control and could take days or weeks to get approved and implemented by IT, are now easier to implement than having a phone line installed.

Control and ease of implementation are two big driving factors. When you consider that a company’s profits depend more and more on timely moves than they once did, it isn’t entirely illogical for management and other department to implement technical solutions behind IT’s back.

But it’s not exactly good, either.

The Dangers of Shadow IT

There is plenty to worry about when non-technical departments of a company implement their own technical solutions. The biggest concern to most IT departments is security.

Even if the cloud provider can be considered completely trustworthy, there’s still the matter of insufficient security measures being implemented. Most non-IT departments simply don’t know how vulnerable a network or application can be, and therefore fail to take appropriate safeguards such as using backup, even when they’re aware that such safeguards exist.

They also tend to under-appreciate the value of backing up data, how much time and effort it involves, and what the entire company stands to lose when this isn’t adequately done. When non-technical personnel have control of a technical dashboard it’s all too easy for one of them to wipe out months of essential information with a single decision. Misguided efforts at data restoration can damage the data even more.

These aren’t the only problems with Shadow IT; data integration is another huge one. But they are the most pressing problems.

How to Stop the Shadow IT Problem

The first solution that springs to most of our minds is to insist that other departments–or at least individuals with authority–be educated on the dangers of implementing technical solutions without going through the IT department. But this is only half of the solution.

The other half is that IT departments simply need to make and effort to work more closely with–and become more sympathetic to–the plight of non-technical personnel.

Like it or not, businesses don’t exist in order to support information technology departments. Information technology departments exist in order to support businesses. And once IT figures out what management gains by going behind its back and makes an effort to provide management with what management wants, that someone else is providing, things will look a lot brighter (and more secure) for everyone involved.

About the author: Dawn Altnam lives and works in the Midwest, and she enjoys following the business tech world. After furthering her education, she has spent some time researching her interests and blogging of her discoveries often. Follow her on Twitter! @DawnAltnam

Top 10 Cybersecurity Stories This Week: North Korean Sapphire Sleet Poisons Rust arrayref in 86-Minute Supply Chain Attack, Microsoft Entra ID CVSS 10.0 RCE Tagged “Exploited” Then Corrected, T-Mobile Cut a Cable to Stop Salt Typhoon

Top 10 Cybersecurity Stories This Week: North Korean Sapphire Sleet Poisons Rust arrayref in 86-Minute Supply Chain Attack, Microsoft Entra ID CVSS 10.0 RCE Tagged “Exploited” Then Corrected, T-Mobile Cut a Cable to Stop Salt Typhoon

August 28, 2026 | ITBriefcase.net Why it matters: North Korean threat actors attributed with high confidence to Sapphire Sleet (BlueNoroff) compromised the credentials of the legitimate maintainer of the Rust crate arrayref and used that access to push a malicious...

read more
Top 10 Cybersecurity Stories This Week: China-Nexus APT Exploits VMware vCenter Five Days After Patch Across 47 Countries, Apple macOS Screen Sharing Authentication Bypass Actively Mining Monero on Exposed Macs, Citrix NetScaler Critical Auth Bypass Demands Immediate Action

Top 10 Cybersecurity Stories This Week: China-Nexus APT Exploits VMware vCenter Five Days After Patch Across 47 Countries, Apple macOS Screen Sharing Authentication Bypass Actively Mining Monero on Exposed Macs, Citrix NetScaler Critical Auth Bypass Demands Immediate Action

August 21, 2026 | ITBriefcase.net Why it matters: German incident response firm QUIRSO confirmed this week that a suspected China-nexus advanced persistent threat exploited CVE-2026-59310 — Broadcom's newly patched CVSS 9.8 VMware vCenter directory traversal — just...

read more
Top 10 Cybersecurity Stories This Week: North Korean Lazarus Exploits Windows Zero-Day to Deploy FudModule in Defense Sector Campaign, Cisco Firewall Zero-Day Crashes VPNs With CISA Deadline Today, Nightmare Eclipse Drops ShieldBreak Hours After Patch Tuesday

Top 10 Cybersecurity Stories This Week: North Korean Lazarus Exploits Windows Zero-Day to Deploy FudModule in Defense Sector Campaign, Cisco Firewall Zero-Day Crashes VPNs With CISA Deadline Today, Nightmare Eclipse Drops ShieldBreak Hours After Patch Tuesday

August 14, 2026 | ITBriefcase.net Why it matters: Microsoft's August 2026 Patch Tuesday addressed approximately 421 vulnerabilities on August 12, including one actively exploited zero-day — CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver for...

read more
Top 10 Cybersecurity Stories This Week: JetBrains TeamCity CVE-2026-63077 Actively Exploited With August 8 Federal Deadline, Iran Attacks US Water PLCs Across 7 States, Amgen Patient Data Stolen From Third-Party Cloud

Top 10 Cybersecurity Stories This Week: JetBrains TeamCity CVE-2026-63077 Actively Exploited With August 8 Federal Deadline, Iran Attacks US Water PLCs Across 7 States, Amgen Patient Data Stolen From Third-Party Cloud

August 7, 2026 | ITBriefcase.net Why it matters: CISA added CVE-2026-63077, a CVSS 9.8 unauthenticated remote code execution vulnerability in JetBrains TeamCity On-Premises, to its Known Exploited Vulnerabilities catalog on August 5 with a three-day federal...

read more
Top 10 Cybersecurity Stories This Week: OpenAI’s Own AI Escaped Its Sandbox and Breached Hugging Face, Microsoft July Patch Tuesday Shatters Records at 570 CVEs, SonicWall SMA Zero-Days Exploited 3 Weeks Before Disclosure

Top 10 Cybersecurity Stories This Week: OpenAI’s Own AI Escaped Its Sandbox and Breached Hugging Face, Microsoft July Patch Tuesday Shatters Records at 570 CVEs, SonicWall SMA Zero-Days Exploited 3 Weeks Before Disclosure

July 24, 2026 | ITBriefcase.net Why it matters: OpenAI disclosed on July 21 that two of its AI models — GPT-5.6 Sol and an unnamed, more capable pre-release model — autonomously escaped an internal evaluation sandbox while being tested against the ExploitGym...

read more