In short: Shadow IT is technology employees adopt without IT's approval, and shadow procurement is its purchasing twin: buying that bypasses the official procurement process. Both are growing fast. Gartner puts shadow IT at 30 to 40% of IT spending in large enterprises and expects 75% of employees to acquire, modify or create technology outside IT's visibility by 2027, up from 41% in 2022. Generative AI has accelerated the trend: in a KPMG and University of Melbourne study, 57% of employees said they hide their use of AI at work. People rarely do this to break the rules. They do it because the official route is too slow. This article covers where shadow IT and shadow procurement come from, what they cost, and why the most effective response is to make the official route the easiest one.
Shadow IT rarely starts with someone deciding to break the rules. It usually starts with a deadline: the official tool is too slow, a SaaS subscription on a company card solves the problem in ten minutes, and a few months later several departments are paying for overlapping tools that nobody in IT or procurement knows about.
This is how shadow IT and shadow procurement work in most organisations: quietly, with good intentions, one purchase at a time.
Shadow IT is any technology employees or departments use without IT's approval or oversight: a personal cloud storage account used to share files, a project management tool set up by a team, or a developer testing code on an unapproved cloud service. The motivation is almost always to get the work done faster.
Shadow procurement is the purchasing side of the same pattern: a department buys a product or service outside the established procurement process. It usually starts with a free trial that works well, gets upgraded on a company card or a departmental budget, and a few months later becomes a business-critical tool with trained users and dependent workflows, while procurement still doesn't know it exists.
Two related concepts help explain why this matters:
Generative AI has made shadow IT easier than ever, because a powerful tool is only a browser tab away. According to the 2024 Work Trend Index from Microsoft and LinkedIn, 75% of knowledge workers already use generative AI at work, and 78% of those users bring their own AI tools rather than using ones provided by the company.
Much of this happens out of sight. In the KPMG and University of Melbourne global study, which surveyed more than 48,000 people in 47 countries, 57% of employees said they hide their use of AI and present AI-generated work as their own. Almost half admitted to uploading sensitive company information into free public AI tools, or using AI in ways that go against company policy. Only 40% said their workplace had any guidance on generative AI.
The risk is different from classic shadow IT. With an unapproved file-sharing tool, the question is where the file ends up. With an AI tool, the question is also what happens to the content afterwards: whether it's stored, used to train models, or shared with third parties. Employees rarely know the answer.
The cost of shadow technology goes well beyond subscription fees. Gartner studies cited by CIO.com put shadow IT at 30 to 40% of IT spending in large enterprises, and Everest Group estimates 50% or more. Zylo's 2025 SaaS Management Index found that lines of business, not IT, now control about 70% of SaaS spend.
| Area | What the research shows | What it means in practice |
|---|---|---|
| Hidden spending |
Sources: CIO.com, Zylo 2025 |
|
| Application sprawl |
Sources: Zylo 2024 and 2025 |
|
| Security |
Sources: Zylo 2024, Kaspersky 2023 |
|
| Shadow AI |
Source: IBM Cost of a Data Breach 2025 |
|
| Compliance |
Source: SEC |
|
Sources: CIO.com, Zylo 2025
Sources: Zylo 2024 and 2025
Sources: Zylo 2024, Kaspersky 2023
Source: IBM Cost of a Data Breach 2025
Source: SEC
The numbers only tell part of the story. The bigger cost is what economists call opportunity cost: savings that are never negotiated, integrations that are never built, and management time spent untangling the organisation's own complexity instead of improving it.
Shadow IT is fundamentally an organisational problem, not a technology one. Four drivers come up again and again:
Speed. When an official request takes weeks or months and a SaaS tool can be up and running in ten minutes, a team under deadline pressure will choose the faster route. Gartner found in a survey of 1,310 employees that 69% had bypassed their organisation's cybersecurity guidance in the previous 12 months, and 74% would do so if it helped them or their team reach a business goal.
Tools that don't fit the work. Employees are used to the quality of consumer apps. If an official system is slow, lacks key features or is hard to use, they look for an alternative.
Capacity gaps in IT and procurement. Central teams often can't keep up with the volume of requests. Every week a request waits in the queue increases the chance that someone solves the problem on their own.
Blurred lines between personal and work technology. Employees who can install a powerful app in a few clicks at home bring that expectation to work.
Shadow procurement is not just a technology question. When departments choose and pay suppliers without central oversight, the organisation ends up with a web of contracts and supplier relationships that nobody manages as a whole.
The consequences are familiar to every procurement team:
Zylo's 2024 SaaS Management Index shows how widespread this is: more than a third of a company's applications are shadow IT, and 67% of IT leaders named rogue software purchases among their top SaaS challenges. Shadow procurement also leads to vendor lock-in. Data gets trapped in proprietary formats, and what started as a quick fix becomes a complex migration project a few years later.
Shadow procurement is closely related to maverick buying, which is usually a user experience problem rather than a discipline problem. We looked at this in more detail in our article on automation without losing control.
Unapproved tools create security gaps simply because nobody is monitoring them. Zylo found that 65% of employee-expensed apps have a "Poor" or "Low" security score. Kaspersky's Human Factor 360 report found that 11% of cyber incidents in the past two years were caused by the unauthorised use of IT.
Shadow AI increases the stakes. According to IBM's 2025 Cost of a Data Breach report, the global average cost of a data breach was USD 4.44 million, and organisations with high levels of shadow AI paid USD 670,000 more on average. 63% of the organisations studied had no AI governance policy at all.
Compliance risk can be just as expensive. In 2022, the US Securities and Exchange Commission fined 16 financial firms more than USD 1.1 billion because employees discussed business on messaging apps that weren't approved, and the firms couldn't retain those records.
The traditional response is to block unapproved apps. In today's environment that rarely works: employees find a workaround, and the organisation loses visibility on top of losing control.
A more useful approach is to treat shadow IT as a signal. Every unapproved tool points to an unmet business need or a process that creates too much friction. Organisations that read these signals as feedback, rather than simply as policy violations, learn exactly where their official systems fall short.
1. Create a fast, official route for experimenting. A list of pre-approved tools, a test environment and a fast-track approval process for low-risk software meet the need for speed without giving up oversight.
2. Make shadow tools visible. Automated discovery tools and card spend analysis show what is really in use. The goal is to understand the patterns and assess the risks, not to punish people.
3. Control the data, not every tool choice. Instead of approving every application one by one, make sure company data flows securely and stays accessible whichever tool is in use.
4. Speed up the official processes. If a procurement or IT request is approved in days rather than months, most employees will choose the official route.
5. Explain before you enforce. People make better decisions when they understand the risks and have a workable alternative, not just a list of rules.
Modern procurement and process platforms tackle the causes rather than the symptoms:
Shadow IT and shadow procurement are not going away: Gartner expects three quarters of employees to work with technology outside IT's visibility by 2027. They are not primarily technology problems, but organisational design problems. They appear when the official systems can't keep up with the pace and needs of the business.
Bans alone won't solve this. What works is making the official route the fastest and easiest one, keeping company data under control whichever tool is used, and reading every shadow tool as feedback on where the systems fall short.
The best way to get rid of the shadows isn't to switch off the light. It's to build systems that are fast, flexible and useful enough that people choose to work in the open.
What is the difference between shadow IT and shadow procurement?
Shadow IT is technology used without IT's approval, such as a SaaS tool, a cloud storage account or an AI assistant. Shadow procurement is buying that bypasses the official procurement process, whether or not the purchase is technology. They often overlap: a SaaS subscription paid for on a company card is both.
How common is shadow IT?
Very common. Gartner puts it at 30 to 40% of IT spending in large enterprises and expects 75% of employees to acquire, modify or create technology outside IT's visibility by 2027, up from 41% in 2022. Zylo found that more than a third of a company's applications are shadow IT.
What is shadow AI?
The use of AI tools, such as public chatbots, without company approval or oversight. According to Microsoft, 78% of AI users bring their own AI tools to work, and in a KPMG study 57% of employees said they hide their use of AI.
Why is shadow AI riskier than other shadow IT?
Because the content employees enter can be stored, used to train models or shared with third parties, and employees rarely know which. IBM found that high levels of shadow AI added USD 670,000 to the average cost of a data breach.
Should shadow IT simply be banned?
Bans rarely work on their own: employees find workarounds and the organisation loses visibility. It is more effective to make shadow tools visible, speed up official approvals and offer official tools that actually meet the need.
How can procurement reduce shadow procurement?
By making the official process faster and easier than going around it: pre-approved suppliers and tools, fast-track approval for low-risk purchases, workflows adapted to each department, and full visibility of card and departmental spend.
.png)
.png)
.png)
.png)
