What the heck is shadow IT?

S

signtwist

Filing Flight Plan
Joined
Dec 1, 2015
Messages
23
Display Name
Display name:
Geoffrey Mason
Can any of you guys explain what shadow IT is? I've been hearing it being discussed by my office mates for a few weeks now and it's not clear to me what it is. Our IT department has been explaining it but i am really not into technical IT stuff, i just need a simple layman's language explanation (if you know what i mean).
 
Unsanctioned IT work, typically done very quietly using non-standard processes and resources. This is practiced when IT resources or processes are seen to be too slow or weak. Aviation analogy might be if an airplane owner/pilot decides to cut corners by doing some of his own mechanical/maintenance work rather than hiring a mechanic to do it - and quietly does not document it - to save money.
 
An example would be when a department begins using a web enabled app/service without involving the IT department. This can be done when all is required is internet access. One common example is sales support applications. There is a whole bunch of tech people supporting the use of the application and often interfacing with the customer and often totally without the knowledge or involvement of the IT department at the customer.
 
The first 8 years of my career I was part of a shadow IT group in the Logistics business group. We created reports and tools using our own processes without having to go through all the red tape that IT had to deal with.

We got a quote from our IT group one time to add a radio button to a web page: $10,000 and like a month of work. There were reasons for us to be there, our users required quick turnaround on updates and creating new reports that IT just couldn't do. IT knew about us and when I started they didn't like us, but by the time I left they had a pretty good appreciation for the benefits we brought to the company and the amount of work we kept off their plate. They worked with us on quite a few projects actually.
 
Fredbob711 said:
The first 8 years of my career I was part of a shadow IT group in the Logistics business group. We created reports and tools using our own processes without having to go through all the red tape that IT had to deal with.

We got a quote from our IT group one time to add a radio button to a web page: $10,000 and like a month of work. There were reasons for us to be there, our users required quick turnaround on updates and creating new reports that IT just couldn't do. IT knew about us and when I started they didn't like us, but by the time I left they had a pretty good appreciation for the benefits we brought to the company and the amount of work we kept off their plate. They worked with us on quite a few projects actually.
Click to expand...

One place I worked we had a designated group who were "first to the fire". They "put water on the fire" so to speak. We produced shrink-wrapped, commercial software. (Anybody remember that?) We also sold private labeled versions to OEMs. If an OEM wanted a feature or had problem, this group would come up with a fix or mod ASAP which would be provided to the OEM in question. Then it would get passed to the production group to integrate and/or fix as required. Then it would become part of the next release. They broke things sometimes, but it was always limited in scope because it would only be in one OEM's package until we got to look at it, fix it and fully test it in production.

The concept worked pretty well in that context.

John
 
There's another meaning behind Shadow IT as well, and it related to outsourced activity. Most big companies will have a well build and structured IT Support Department, IT Development Department, etc. etc. It is not uncommon for a vendor to supply a SaaS product with customized development and support included for a nominal fee, often times better than using the internal IT team.

This is often called "Shadow IT" services, and its not necessarily a bad thing. Some IT departments will embrace it, provided the IT department is given oversight to the end result of the Shadow Service.
 
In large organizations "shadow IT" projects work great for one-off things that will truly make or save a department a metric ton of money or save them a ton of time. Boutique stuff. "Real IT" will often be able to easily look the other way in that case.

The disasters are when they're used for services already built that someone just "didn't like". Or worse, built into a security or network stability problem/nightmare that affects others.

If it's a disaster, "real IT" ends up fixing it if the thing is useful, often costing as much as was originally estimated but done in an "emergency" basis so easier to get approval for... or shooting it in the head, and making an example out of the people who did it, if it's not that useful.
 
It can also refer to processes that a firm's internal IT staff perform when their documented procedures are too burdensome - or they just don't feel like adhering to the procedure. Not a good thing in that circumstance.
 
iflyvfr said:
It can also refer to processes that a firm's internal IT staff perform when their documented procedures are too burdensome - or they just don't feel like adhering to the procedure. Not a good thing in that circumstance.
Click to expand...


Depends on if the procedures were any good to begin with. The assumption that they are worth doing, is often another source of failure. Some larger companies force themselves into analysis paralysis and can't get started on things that need doing.

I'd usually call this "guerrilla IT" vs "shadow IT", however.
 
SkyHog said:
There's another meaning behind Shadow IT as well, and it related to outsourced activity. Most big companies will have a well build and structured IT Support Department, IT Development Department, etc. etc. It is not uncommon for a vendor to supply a SaaS product with customized development and support included for a nominal fee, often times better than using the internal IT team.

This is often called "Shadow IT" services, and its not necessarily a bad thing. Some IT departments will embrace it, provided the IT department is given oversight to the end result of the Shadow Service.
Click to expand...

35 years in the business and I have never heard using outsourced resources being referred to as shadow IT. Outsourced, co-sourced maybe.

It is not uncommon to use an outside vendor for both development and support work, but Shadow IT, as previously stated, is work performed outside a normal IT org, usual born out of frustration with the real IT department due to cost and or schedule. The problem starts when a system or solution developed by shadow IT has a major issue, or the sole person who used to support it on their PC, is no longer with the company - their expect the "REAL IT " department to fix it. Guess what, they are SOL !!!

BEEN THERE, DONE THAT !!!
 
Scrabo said:
35 years in the business and I have never heard using outsourced resources being referred to as shadow IT. Outsourced, co-sourced maybe.

It is not uncommon to use an outside vendor for both development and support work, but Shadow IT, as previously stated, is work performed outside a normal IT org, usual born out of frustration with the real IT department due to cost and or schedule. The problem starts when a system or solution developed by shadow IT has a major issue, or the sole person who used to support it on their PC, is no longer with the company - their expect the "REAL IT " department to fix it.
Click to expand...

Must have been 35 Years working for the same company that uses nonstandard terms. Or a company that hasn't accomplished jack squat that required outsourced services significant enough to have to use standard terminology. 35 Years working IT for Jack in the Box doesn't count.

Nick - an outsourced resource specialist and leader.
 
SkyHog said:
Must have been 35 Years working for the same company that uses nonstandard terms. Or a company that hasn't accomplished jack squat that required outsourced services significant enough to have to use standard terminology. 35 Years working IT for Jack in the Box doesn't count.

Nick - an outsourced resource specialist and leader.
Click to expand...

That's funny, we have nothing but outsourced IT resources from 12 or so different vendors worldwide for both software and hardware/infra. Due to the nature of our business, we can't use SaaS, IaaS or PaaS, not by choice but by contractual restrictions.
 
Scrabo said:
That's funny, we have nothing but outsourced IT resources from 12 or so different vendors worldwide for both software and hardware/infra. Due to the nature of our business, we can't use SaaS, IaaS or PaaS, not by choice but by contractual restrictions.
Click to expand...

Maybe since you have no IT department, you don't need to know what Shadow IT is. That would make sense too.
 
Let me put it this way, it is common enough that I just finalized a contract on Friday where "Shadow Services" was included as a non-capitalized, undefined term that everyone understood.
 
SkyHog said:
Maybe since you have no IT department, you don't need to know what Shadow IT is. That would make sense too.
Click to expand...

We still have a very large IT department, there are just some things you can't outsource again due to government restrictions.

I don't know what business you are in, but I never have a vendor call themselves "Shadow IT"

"Shadow IT" by its very name, implies work being performed outside any structured or controlled/supported organization.

"Shadow IT is a term often used to describe information-technology systems and solutions built and used inside organizations without explicit organizational approval It is also used, along with the term "Stealth IT", to describe solutions specified and deployed by departments other than the IT department"
 
Last edited:
SkyHog said:
Must have been 35 Years working for the same company that uses nonstandard terms. Or a company that hasn't accomplished jack squat that required outsourced services significant enough to have to use standard terminology. 35 Years working IT for Jack in the Box doesn't count.



Nick - an outsourced resource specialist and leader.
Click to expand...


LOL. "Non-standard terms"?

"Shadow IT" is a term generated relatively recently by trade rags sold to executives.

It's simpler to just call it whatever it is. Unauthorized projects, a VP with a budget who wants something his counterpart at the C level said was too expensive to be done correctly, a nice departmental server that does something useful and isn't harming anything or anyone as long as it doesn't cross the lines defined by requirements for certifications or audits required by contracts or law... Whatever.

No point in worrying about whatever silly name someone gives it trying to make it look bad or good. Just analyze it for the needs of the business and whether it meets the standards of the company as well as the fiscal goals.

I hear there's "shadow pooping" going on in the bathrooms, too. Oooh. I better investigate. Haha.

One distinct benefit of working for a smaller organization is it's impossible to hide dumb stuff from everyone. It's also impossible to hide the good stuff.

If it makes it saves the company significant money, or it saves the company significant time, without putting the company at unnecessary risk... It's good tech.

One of the largest risks any IT manager has to face is the risk of inflation of costs by an outside entity. Obviously any company of any size must rely on vendors, but not watching what they're billing is a very common fiscal mistake that can lead faster to disaster than a whole lot of other things.

The company I work for paid an outsourced IT company hundreds of thousands of dollars early in their history to do nothing more than run a few audit scripts on a pretty poorly executed Windows domain controller. The scripts produced about a three inch binder of nice color charts and graphs that made it look like they were receiving a good value.

My predecessor dropped them and went to work changing the setup but not truly understanding that he needed to be responsive to business needs or at least communicate effectively why he couldn't do certain things that non-experts wanted and show them the risks those things entailed. He survived about six or seven years that way, and then was walked to the door before they'd made me an offer.

My continuation of the cleanup has mostly included utilizing resources already on hand in an industry standard way. Added a server and replaced an aging and failing firewall. Dropped telecom circuits that were too expensive and implemented ones with higher reliability and lower cost. Replaced the very old phone system with one from a reputable vendor and integrated it with our own systems. This year is moving the entire production IT "farm" off of a vendor that's overcharging and underperforming to a platform where we have complete control over the whole thing.

You just do it smart. It doesn't matter what goofy names you call it. A cleanup like this one is similar to taking the Pacific islands in WWII. There's going to be casualties and you have to take them one by one until there's no more to take. If someone in some department wants to go around us and put in something that actually works and is supportable and maintainable? Hell, I won't get in their way.

The CTO has done some of that, forcibly moving certain things to cloud services. When he does that, I'm game to follow behind with a stick and beat people off of the old unmaintainable systems and completely decommission them, rather than limp them along to keep a few people who won't move on, happy.

"The company standard set by the CTO is now X. Y will be shut down next month on the 1st, never to return. Please send any concerns about missing features or pricing for this change to us and copy the CTO, or here's my phone number and it's always on. Attached please find departmental pricing estimates for this service. Thanks, Nate".

Whatever works. The internal chat server gets shot in the head next month and the CTO chose the outside vendor and product and had been using it for his teams for a while. One less virtual machine to manage, patch, upgrade, and maintain. No client to install on system images. The outsourced cloud system is nearly 100% self-service and allowing specific admin users is a piece of cake.

Win/win. IT never suggested a change because those were all "sunk" costs and budget wasn't allocated to make that change. CTO had a budget and a credit card. Good for him. Go "shadow" IT! Fine by me.
 
Outsourcing is expensive, even more expensive if you are limited to using US Citizens for certain functions, then they really stick it to you.

Like most IT departments over the last 15 years, the pressure has been to replace "expensive" employees with contractors but those contractors can end up costing more, the only thing you really get is the flexibility to adjust your resource levels almost overnight , you no longer have to pay an employee salary, health care contributions, 401K contributions etc, you just make it someone else's problem.
 
Scrabo said:
...you no longer have to pay an employee salary, health care contributions, 401K contributions etc, you just make it someone else's problem.
Click to expand...


Oh you're still paying for it, and then some. Contractors aren't in the biz for their health and the joy of weekly travel.
 
denverpilot said:
Oh you're still paying for it, and then some. Contractors aren't in the biz for their health and the joy of weekly travel.
Click to expand...

Agree but "management" decided to cut employees and move the work outside under the disguise of 'saving money' - I know they are full of it. I have an extremely large contract and I could retire very comfortably on what we pay them for one monthly invoice.
 
The real value in outsourcing comes from the triangle: cheap, fast, or good. You'll never get all three (I know, it is trite and overused, but very accurate).

So, you have a Datacenter that is near capacity, and a need to stand up a gigantic application that is going to far exceeded your internal capacity. You have 3 options:

1. Retire enough existing capacity to make space
2. Colocate or build a new data center
3. Outsourced hosting, including box and wire, rack and stack

So, I help you pick which of the three you're gonna do. Now you want to control costs and quality. Well, now you have to decide - do you want it cheap and fast but lower quality, cheap and good, but take forever, blah, blah.

My job is to balance that and make sure it is cheap enough, good enough, and fast enough to make the stakeholder happy (well, sort of, there is a lot more to my joB, including managed service vendors and SLA management, etc.)

So in other words, I have a ton of experience in this. And I can say, with certainty, the word "shadow" in "shadow it" doesn't mean shady or unapproved. It means "done in the shadow of normal IT" (which MAY mean shady or unapproved). When a vendor is offering "shadow services," they are offering services that SHOULD match internal requirements, but without internal oversight or influence. Therefore, you see the output is good enough to have been done internally, but without the need to expend internal IT staff effort.

If that term is common between media and entertainment IT, Tobacco IT, and medical IT, I'm going to go ahead and call it common and standard. I first heard the term 8 years ago, and even then people knew what it meant.
 
denverpilot said:
Oh you're still paying for it, and then some. Contractors aren't in the biz for their health and the joy of weekly travel.
Click to expand...

There are a lot of benefits that come with outsourced IT services. Cost is actually beneficial because turnover is handled by the vendor, as is training expenses and other overhead costs.

For high burn out, high turnover jobs, it is easy to save money outsourcing. For jobs where talent is stable, it only makes sense when there is a value add that can't be done internally (project mgmt, new technology development, etc.).
 
SkyHog said:
The real value in outsourcing comes from the triangle: cheap, fast, or good. You'll never get all three (I know, it is trite and overused, but very accurate).

So, you have a Datacenter that is near capacity, and a need to stand up a gigantic application that is going to far exceeded your internal capacity. You have 3 options:

1. Retire enough existing capacity to make space
2. Colocate or build a new data center
3. Outsourced hosting, including box and wire, rack and stack

So, I help you pick which of the three you're gonna do. Now you want to control costs and quality. Well, now you have to decide - do you want it cheap and fast but lower quality, cheap and good, but take forever, blah, blah.

My job is to balance that and make sure it is cheap enough, good enough, and fast enough to make the stakeholder happy (well, sort of, there is a lot more to my joB, including managed service vendors and SLA management, etc.)

So in other words, I have a ton of experience in this. And I can say, with certainty, the word "shadow" in "shadow it" doesn't mean shady or unapproved. It means "done in the shadow of normal IT" (which MAY mean shady or unapproved). When a vendor is offering "shadow services," they are offering services that SHOULD match internal requirements, but without internal oversight or influence. Therefore, you see the output is good enough to have been done internally, but without the need to expend internal IT staff effort.

If that term is common between media and entertainment IT, Tobacco IT, and medical IT, I'm going to go ahead and call it common and standard. I first heard the term 8 years ago, and even then people knew what it meant.
Click to expand...

#3 is not an option for us, I also have ton of experience in this and I bet if on Monday I go around the department including vendors and ask what is "Shadow IT" - I strongly doubt "done in the shadow of normal IT" would be a reply.

Don't know what handbook you have been reading.
 
You must log in or register to reply here.
Back
Top