Tech teamRunning a website or small org
Shadow IT
Staff using apps and services no one has checked or approved.
Understand it
When the official tools are awkward, people reach for their own - a personal drive, a free app, a chatbot - to get on. Understandable, but your data ends up where you can neither see nor protect it.
How to spot it
Work files on personal accounts, unknown apps joined to company logins, data in services never signed off.
Close the gap
- Make the approved tools good enough that people do not go round them.
- Keep a short list of sanctioned apps, and make it easy to ask for more.
- Review what is connected to your company accounts.
- Lead with “here is the safe way”, not simply “no”.
What to do about it
This sits with whoever builds and runs your website or systems - it’s beyond what a personal plan should promise to fix. If that’s not you, hand it to whoever looks after your security. We’d rather be honest about where we stop.
Your own accounts and devices are still worth protecting; your plan covers those.