Shadow IT
Technology used inside an organisation without approval or visibility from IT and security.
Updated
Shadow IT is a demand signal: people adopt unsanctioned tools because the sanctioned path is missing or too slow. Prohibition without an alternative moves the activity to personal accounts, where nothing is logged.
Providing a fast, monitored, sanctioned path is what actually reduces exposure. The same dynamic now dominates AI adoption specifically: most employees using generative AI at work do so through tools brought in on their own initiative, and most organisations have an AI usage policy without the technical controls to enforce it — the same gap that used to define shadow IT before sanctioned alternatives closed it.
Related
Allegro Group
Security work at Europe's largest e-commerce marketplace: cloud security, identity, governance redesign and internal enablement.
AI governance & AI Act readiness
Build a workable AI governance framework: system inventory, risk classification, acceptable-use policy, review gates and AI Act evidence.
CISO advisory
Security leadership support for organisations without a full-time CISO: strategy, roadmap, board reporting and vendor decisions.
Tabletop exercises
How to design and facilitate a security tabletop that surfaces decision gaps instead of confirming that everyone has read the policy, and how it fits DORA/NIS2 testing obligations.
From Threat Modeling to a General Principle
Thoughts on threat modeling
Security Architects — founder
Independent security consulting practice: cloud and AI security assessments, threat modeling, compliance readiness and CISO advisory.