Shadow IT is rarely malicious. Someone needs to get a job done, finds a tool that works and signs up with their work email. The trouble is that nobody else knows the tool exists, what data is in it or who can reach it.
The risk grows when the app is connected to company accounts. A one-click sign-in or app consent can give a tool lasting access to mail, files or calendars, and that access often outlives the person who granted it.
Shadow AI is the newest and fastest-growing kind of shadow IT, because AI tools invite people to paste in exactly the data a business most needs to protect.
Where it shows up
- Apps granted access to mailboxes, files or calendars that nobody remembers approving
- Work data in personal cloud drives or free file-sharing sites
- Sign-ups to online tools with work email addresses, outside any purchase process
How Centeye handles it
Centeye Gatewatch lists every app granted access to mail and files and who approved it. Centeye Lumen does the same for AI tools and puts each one in a register with an owner and a review date.
Lumen: AI governance and registry →Go deeper: Shadow AI and NHI