In most Polish SMEs there are more IT tools running today than the owner knows about. Some are paid for from the company card, some from private accounts, some sit on free plans full of company documents. It has a name — shadow IT — and it doesn't go away on its own.
Most articles about shadow IT read as if it were a problem invented for 5,000-employee corporations. In practice, a 25-person company often has it worse, because nobody is watching. A sales rep sets up Trello "for themselves", marketing grabs Canva Pro "just for now", an accountant drops files onto a private Dropbox "because it's faster". A year in, twelve tools are circulating, nine of them hold customer data, and none has managed access.
This isn't a story about bad employees. It's a story about company IT not keeping up — so people built a workaround just to get work done at all.
What shadow IT really is
Shadow IT is any IT tool used in the company without the knowledge and approval of the IT function (or the person who plays that role). It's not only paid SaaS. It also includes:
- private Gmail accounts used for company correspondence,
- free plans of Trello, Notion or Slack holding company data,
- company files sitting on private OneDrive or Google Drive accounts,
- Excel scripts and macros that "rescue" a process, but only Jan from accounting knows how they work,
- unsanctioned browser plugins that "scan" emails or PDFs.
None of this is automatically evil. The point is that the company doesn't know it exists — so it can neither secure it, revoke it when someone leaves, nor count how much it really costs.
Why people do it
Shadow IT almost never starts with bad intent. It starts for three very understandable reasons:
- The official tool doesn't work, or works badly. The company SharePoint is so slow that loading a file takes two minutes. So the sales rep drops the pricelist on a private Dropbox "real quick".
- There is no official tool. Marketing needs something to design leaflets. Nobody bought them anything. They take free Canva and get on with it.
- Going through IT takes too long. A presentation has to go out Friday, and a ticket to IT will be answered Wednesday. The employee grabs WeTransfer or a personal email — done.
If shadow IT is thriving in your company, it isn't a discipline problem. It's a signal that your official tools or processes don't close the loop on what people actually need to do.
Three hidden costs
Shadow IT is not free, even if each of those accounts looks like a small thing.
1. Security. An employee leaves. IT closes their email, VPN and ERP account. But nobody knows that employee also had access to a company Dropbox set up under their private address — because that Dropbox was never on any list. Six months later, a competitor's pricelist "oddly" resembles yours. Second scenario: a private Trello board with customer data and order details ends up public after a one-click permissions change. Leaks through shadow IT are among the hardest to detect, because that hole, formally, never existed in the company.
2. Money. SaaS subscriptions are spend that grows quietly. One Polish SME where we did a license audit — a 28-person industrial parts distributor — turned out to be paying every month for: 4 × Trello Business (each team had its own), 3 × Dropbox Business, 2 × Notion Plus, one Canva Pro, one Loom Business and a "private" Mailchimp running the sales newsletter. About 1,100 PLN per month of pure duplication — tools that on a single corporate account would cost a fraction. After consolidation to Microsoft 365 Business Standard + SharePoint + a single shared Trello workspace, the saving was ~13,200 PLN per year. And that wasn't even the main win.
3. Data as islands. This is the silent killer of AI and automation. If offers live in Pipedrive, invoices in Comarch Optima, projects in Trello, documents in Dropbox, and leads in Excel on someone's private Google Drive — no analytics tool, no report, no "AI assistant" will give you a sensible answer to "how much do we actually earn on customer X". Because the answer is scattered across five accounts, two of which belong to ex-employees.
How to run a quiet audit
Fighting shadow IT isn't about emailing out a ban. It's about inventorying reality, then cleaning up gradually. Roughly four steps:
- Step 1 — start with the invoices. Pull the company card statement for the last 12 months. Every charge above ~30 PLN/month that you can't immediately identify goes on a list to investigate. This usually surfaces 70% of the paid shadow IT.
- Step 2 — ask teams what they actually use. Not "are you using anything you shouldn't" (nobody will admit it), but "show me what you work with day to day". Ideally a 30-minute conversation per team, no judgement. Everything comes out.
- Step 3 — for each tool, ask three questions. Do we have admin control over it? Are company or customer data in it? Does it disappear when that employee leaves? If even one answer is awkward — the tool goes on the cleanup list.
- Step 4 — propose a replacement before you ban anything. Telling people "no private Dropboxes" isn't enough. You have to show that the company SharePoint or OneDrive is just as fast, and that an admin controls permissions. Without that, employees go right back to their workarounds — just more quietly.
A full audit like this in a 20-40 person company typically takes 2-3 weeks, with the actual conversation part being max 8 hours. The rest is sorting the tool list, negotiating shared accounts and switching off what nobody uses anymore.
What next
Shadow IT won't vanish from the company once and for all. It's a living phenomenon — every new business need will produce another workaround if official IT doesn't keep up. A sensible goal isn't "zero shadow IT", it's knowing where it is and keeping control over where the company's data lives.
If you suspect your company runs more tools than you could list from memory, this is a good moment for a first audit. Half an hour on a call is usually enough to point you at where to start. We don't sell licenses, so we have no interest in pushing you into anything.
Shadow IT isn't a discipline problem. It's a signal that your official tools don't close the loop on what people actually need to do.