Shadow IT

Any technology, system, application, or data process used inside an organization without the knowledge, approval, or oversight of the IT or data governance function. Historically referred to unsanctioned SaaS subscriptions; now spans five distinct channels including spreadsheets, exports, personal databases, unsanctioned SaaS, and unsanctioned AI tools.

An earlier, related organisational phenomenon: employees adopting software tools without formal procurement or security review. Named here to distinguish agent sprawl (which frequently leaves no trace a traditional audit would catch) from its slower-spreading predecessor.

Any system, spreadsheet, personal database, browser extension, or software tool adopted by employees to do their work without going through an organization's formal procurement, security review, or IT visibility process. Almost always a rational workaround for a slow, restrictive, or absent official system, not a malicious act.

Technology, including spreadsheets, exports, personal databases, and unsanctioned AI tools, adopted and used to support a real business process without being documented, approved, or governed by the organization's official systems and data governance process.