--- title: 'Shadow IT: the invisible infrastructure exposing your organization' url: 'https://argobs.com/en/shadow-it-linfrastruttura-invisibile-che-espone-la-tua-organizzazione' markdown: 'https://argobs.com/en/shadow-it-linfrastruttura-invisibile-che-espone-la-tua-organizzazione.md' lang: en date: '2026-03-11' description: 'Every day, in thousands of organizations, the same pattern repeats. An employee sends a file through WeTransfer because the company mailbox cannot handle large attachments. A colleague saves a presentation to a personal Dropbox to work on it from home. Someone else uploads a document containing per…' taxonomy: category: - articoli - cybersecurity --- # Shadow IT: the invisible infrastructure exposing your organization 11 March 2026 | Articles, Cybersecurity Every day, in thousands of organizations, the same pattern repeats. An employee sends a file through WeTransfer because the company mailbox cannot handle large attachments. A colleague saves a presentation to a personal Dropbox to work on it from home. Someone else uploads a document containing personal data to an online PDF compression service. Another pastes a contract into ChatGPT to get a summary. These behaviors occur at every level of the hierarchy: those who engage in them do not think they are doing anything wrong, and those who should be overseeing information security, in most cases, are not even aware of them. This phenomenon has a precise name: Shadow IT — the set of devices, software, cloud applications and digital services used within an organization without the approval or control of the IT department. These are not malicious tools: Google Drive, Notion, Trello, Canva, automatic translation services and AI-based chatbots are widespread and well-liked products. The problem is that they are adopted independently, outside any corporate governance and without any risk assessment. The pandemic and the normalization of remote work have greatly accelerated the phenomenon: when employees cannot find a quick solution through official channels, they look for one on their own. It is an understandable reaction — and an extremely dangerous one. #### **Why Shadow IT is a security problem** When an employee uses an unauthorized service, the organization loses control over a link in its own security chain. Files uploaded to personal sharing platforms end up on cloud infrastructures whose geographic location and security policies the company knows nothing about — and if those servers are outside the EU and the files contain personal data, an unauthorized international transfer occurs. The many free online file compression and conversion services deserve a specific mention: they are convenient and extremely common, but they work by uploading the document to remote servers, often under terms of service that provide for file retention and, at times, the right to use the files for the provider's own purposes. In addition, tools adopted independently rarely offer, in their free versions, the safeguards required in a business setting: end-to-end encryption, multi-factor authentication, access logging, centralized credential revocation. Every unmonitored application is also a potential entry point for cyberattacks — a compromised personal account can become the gateway to the corporate network, especially if the employee reuses the same credentials. And if a data breach occurs on a platform whose use the company is unaware of, the breach may not be detected within the 72 hours provided by Art. 33 of the GDPR for notifying the Supervisory Authority. On the NIS2 front, the picture becomes even stricter for organizations within the scope of Directive (EU) 2022/2555, transposed in Italy by Legislative Decree 138/2024. The Directive requires appropriate security measures across the entire digital supply chain (Art. 21), including the management of suppliers and third-party ICT services. A cloud service adopted independently by an employee is, to all intents and purposes, an ICT supplier that is neither contracted nor assessed: exactly the kind of gap the Italian National Cybersecurity Agency (ACN) is tasked with policing. For essential and important entities, the inability to map the tools in use can translate into structural non-compliance, with fines of up to €10 million or 2% of worldwide turnover for essential entities, and €7 million or 1.4% for important entities. For financial organizations subject to the DORA Regulation (Digital Operational Resilience Act – Reg. EU 2022/2554, applicable from 17 January 2025), Shadow IT is a digital operational resilience risk that is hard to manage. DORA requires a complete register of all third-party ICT providers (Art. 28), an assessment of concentration risk and specific contractual clauses with each of them. A service that is unapproved and unrecorded is by definition excluded from this register, making compliance impossible. The supervisory authorities — Banca d'Italia, IVASS, Consob — may request documentary evidence of this mapping during an inspection. #### **Shadow IT and GDPR violations** From a compliance standpoint, Shadow IT is a systemic risk. Regulation (EU) 2016/679 "GDPR" imposes obligations on the controller that become structurally impossible to meet if part of the processing takes place on unknown platforms. If the personal data of customers, suppliers or employees is processed through an unrecorded service, it is very likely that the processing does not appear in the record of processing activities (Art. 30), is not covered by a compliant privacy notice (Arts. 13-14), has no valid legal basis and is not covered by a data processing agreement under Art. 28. In other words: if an employee uses WeTransfer or a generative AI service to process personal data, that provider is processing data on the organization's behalf without any Data Processing Agreement in place. The problem is amplified by transfers outside the EU. Many of the most common services in Shadow IT are based in the United States or rely on US cloud infrastructure, and transferring personal data to third countries requires — also in light of the Data Privacy Framework and the Schrems II case law — a case-by-case assessment and the adoption of adequate safeguards. None of this happens when the tool is adopted independently. The same applies to the use of free AI models not approved by the company: when an employee enters confidential information into a prompt, that data is transmitted to a third party without any of the safeguards provided by the GDPR and, in some cases, may be used to train the model. #### **How to map and manage Shadow IT** The first step is to make the phenomenon visible. Monitoring DNS traffic and firewall logs makes it possible to identify connections to unauthorized cloud services. Periodically checking the applications installed on company devices — including browser extensions — helps detect unapproved software. For more structured organizations, adopting a Cloud Access Security Broker (CASB) enables real-time monitoring. And a systematic comparison between the record of processing activities and the tools actually in use can reveal significant discrepancies. The most direct approach should not be underestimated either: asking employees which tools they use in their daily work, in a collaborative rather than inquisitorial spirit, is surprisingly effective. For organizations that have adopted or aspire to ISO/IEC 27001:2022 certification, controlling Shadow IT is not optional: control 8.8 (management of technical vulnerabilities) and control 5.23 (information security for use of cloud services) explicitly require the organization to identify, assess and manage the cloud services in use. A certification audit that finds widespread use of unauthorized and unassessed services typically results in a major nonconformity, with a direct impact on the certification itself. Eliminating Shadow IT completely is an unrealistic goal. The effective approach is to govern it, and this requires action on several levels. First, a clear policy listing the authorized tools, the prohibited ones and the procedure for requesting new ones — actively communicated, not buried in an internal rulebook nobody reads. Then, corporate alternatives that meet real needs: if employees turn to WeTransfer it is because the mail system cannot handle large files, and if they use a personal Dropbox it is because adequate cloud storage is missing. Shadow IT is often the symptom of an IT infrastructure that does not meet operational needs, and fixing the cause is always more effective than fighting the effects. Finally, structured training: employees must understand why using unauthorized tools is a risk, through concrete and recognizable scenarios. #### **Endpoint management: the most underrated technical measure** Among the most effective solutions is the adoption of an endpoint management platform, which maintains an up-to-date inventory of hardware and software on every company device, identifies unauthorized applications, enforces security policies centrally and allows remote intervention in case of critical issues. From a compliance standpoint, a platform of this kind directly addresses the obligations of Art. 32 GDPR: visibility over endpoints makes it possible to document risk assessments with full knowledge of the facts, automated patching reduces vulnerabilities, continuous monitoring supports compliance with notification obligations (Art. 33) and the logs generated provide documentary evidence in the event of an inspection. A structured endpoint management system also helps meet the requirements of ISO 27001:2022 (in particular controls 8.8, 8.19 and 8.32, the last on change management), the NIS2 requirements on technical and organizational measures, and — for DORA entities — the building of the ICT risk management framework required by Art. 6 DORA. Among the solutions available on the market, NinjaOne is one of the platforms that Argo Business Solutions has evaluated and adopts within its consulting services, for its unified console, automated patching and compatibility with GDPR requirements. If your organization does not yet have an endpoint management (or RMM) solution, or wants to check whether the one in use adequately covers regulatory requirements, Argo can support you with evaluation, implementation and configuration, integrating the platform into a structured compliance path. #### **Conclusion** Shadow IT is not a technology problem. It is an organizational, cultural and regulatory problem that stems from the gap between what employees need to do their work and what the company provides them with. Addressing it requires clear policies, structured training, adequate tools and an endpoint management platform that turns the invisible into the governable. Only then is it possible to move from declared security to effective — and demonstrable — security. If the Garante carries out an inspection, "we didn't know" is no defence. In fact, not knowing is exactly the problem. Whether the context is GDPR, NIS2, DORA or ISO 27001, the starting point is always the same: you cannot protect what you do not know you have. And you cannot demonstrate compliance with a regulation if part of your processing takes place on invisible platforms. *Argo Business Solutions S.r.l. supports organizations in managing GDPR compliance, assessing IT risks and implementing endpoint management solutions. For advice on Shadow IT and the protection of company data, contact us.* --- ## Navigation - Parent: [News](https://argobs.com/en/news.md) - Previous: [Cyber Resilience Act: getting compliant ahead of the upcoming deadlines](https://argobs.com/en/cyber-resilience-act-essere-conformi-in-vista-delle-prossime-scadenze.md) - Next: [Counterfeit products and health risks: a problem for brands too](https://argobs.com/en/prodotti-contraffatti-e-i-rischi-per-la-salute-un-problema-anche-per-i-brand.md)