Shadow IT or Through IT? — TechKnowSurge

About this interactive

The Acquisition and Procurement lesson defines shadow IT as users or departments going around the IT department for something they should go through it for: buying a printer or a headset themselves, or signing up for a cloud service on their own. The lesson gives four reasons it hurts. IT may already have spares, so the money is wasted. The product may break company policy, such as an inkjet when the company is moving to laser printers or going paperless. IT may not be able to support it, though the user expects it to. And data can end up out of the company's reach: in the lesson's story, a department ran a cloud service on personal accounts, the people were laid off, and the company could not get to its own data. Who pays is not the test. A department can pay from its own budget and still go through IT, if IT reviewed and approved the purchase or set it up on a company account. Asking IT first, using its request process, or taking a product from IT's stock all count as going through IT. A quick test for each card: did IT know and have a say before the product was bought or the service set up?

What you'll learn

Recognize shadow IT: a user or department going around the IT department for something that should go through it
Tell a purchase or setup that went around IT from one that went through IT, even when a department pays from its own budget

Aligned to

CompTIA Security+

4.2 Explain the security implications of proper hardware, software, and data asset management.

2.1 Compare and contrast common threat actors and motivations.

Key terms

Shadow IT: The use of unauthorized software, systems, or services within an organization without IT department knowledge or approval. Shadow IT creates security blind spots because unmanaged assets fall outside standard patching, monitoring, and access controls.
Procurement: The process of acquiring goods and services for an organization, ensuring purchases align with company policy, standards, and IT requirements.
Software as a Service: A cloud service model that delivers software applications over the internet on a subscription basis.
Needs Assessment: The process of identifying and defining a business requirement before evaluating or selecting a vendor or solution.

Topics

Asset Management Shadow It Procurement Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →