[blencdr]

This is a CISO's nightmare fuel. Shadow IT is a real pain, consisting of systems with no ownership, no control, and possibly a tight link with the inner IT system.

And the majority of this is only exacerbated by the complexity of the decision-making process.

[Leo_Germond]

And yet, most IT will see it as an opportunity for locking down systems and policies, instead of the call for help shadow IT is: people want systems that are reliable, efficient, and adaptable to rapidly changing business needs. Providing them is part of the core mission of IT, and they're failing at it in some companies. One anecdotal example: I'm responsible for doing trainings at my company. If I see someone providing trainings on their own, creating their own class material, using their own platform... basically wasting company resources; I don't consider it shadow training but I take it as an indication that A. they have a need B. are very willing to work to achieve it and C. I'm not filling up that need properly, maybe not even communicating correctly about it. I take ownership and I don't play vigilante. When IT are providers, helpers to the employees, instead of self-appointed inquisition on a mission to purify the systems and its users, it works for the best.

[rcxdude]

This. Shadow IT is a symptom, not the disease.

[wil421]

At my company IT wants funding before you even talk to them. After you play the shell game it’s months and months before a half baked solution is cobbled together. So we have Shadow IT, our own Linux servers, JIRA, git, and now a couple off the shelf SaaS products we can configure ourselves and skip IT all together.

[ckdarby]

Yet the CISO's are the very folks driving Shadow IT.

I've been at a company where getting a Slack plugin approved took 8 months alone. Vendor review took a year.

These departments aren't equipped for the modern day and most want to live 10 years ago without change. Just keep with the old and vest.