Shadow IT, also called grey IT, refers to devices, software and cloud services used for business purposes without being known to or managed by the IT and security teams. Because these assets sit outside asset management and policy, they are not patched, monitored or backed up in the usual way.

Common forms

• Personal cloud storage or file sharing used to move work documents.
• Software-as-a-service tools signed up for with a work email, without review.
• Test servers, websites or cloud instances that a team set up and forgot.
• Personal devices connected to company systems.
• AI tools used without permission, sometimes called shadow AI, which may receive confidential data.

Shadow IT usually grows because people need to get work done and the approved tools are slow or missing. Good mitigation combines discovery with offering usable, approved alternatives.

Why it matters for dark web monitoring

Unknown assets are a common source of leaks and break-ins. Data copied to an unmanaged cloud account can be exposed without anyone noticing, and a forgotten server with an old login page is an easy target. Shadow IT often first becomes visible from the outside: in leaked credentials for an unapproved service, in data offered for sale, or in an external scan of the attack surface. Monitoring services discover internet-facing assets that are missing from the inventory.

Sources: NCSC: Shadow IT