Shadow IT is no longer a niche behavior because 45% of organizations still let employees procure and use software without IT approval. Worse, 56% of IT leaders say it happens at least weekly, and 61% of enterprises admit they have unmanaged SaaS applications floating around. By connecting these patterns to real breach drivers, cost, and compliance friction, the dataset reveals how a “minor” workaround can quickly turn into measurable cybersecurity risk.
Key Takeaways
- 45% of organizations allow employees to procure and use software without IT approval (i.e., “shadow IT” behaviors)
- 56% of IT leaders report that their organization experiences shadow IT at least weekly
- 61% of enterprises say they have unmanaged SaaS applications in their environment
- 60% of enterprises reported SaaS sprawl as a top challenge (with implications including shadow IT)
- 57% of respondents say unmanaged cloud services increase the risk of account takeover and credential theft
- 52% of organizations say they have difficulty classifying shadow IT data for compliance purposes
- In the Verizon DBIR 2024, 11% of breaches involved “misconfiguration/error,” commonly linked to uncontrolled tools and services
- In the Ponemon Institute / IBM study, the average cost of a breach with “third-party involvement” was $5.76 million in 2024
- In the 2024 (ISC)² study, organizations reported needing 1.5 million additional cybersecurity workers in the Asia-Pacific region alone
- In the 2024 CrowdStrike Global Threat Report, 70% of ransomware victims were targeted multiple times before the attack
- NIST SP 800-53 Rev.5 includes 4,300+ security controls total across control families (governance scope relevant to shadow IT bypass)
- CIS Controls v8 contains 18 controls and 153 sub-controls for enterprise security governance (helps standardize oversight against shadow IT)
- CIS Benchmarks include configuration guidance for 1,000+ settings for common technologies (supporting standardized enforcement)
Shadow IT is widespread and risky, driving SaaS sprawl, account takeovers, compliance headaches, and higher breach costs.
Related reading
01 · Category
Shadow It Prevalence4 stats
01
45% of organizations allow employees to procure and use software without IT approval (i.e., “shadow IT” behaviors)[1]
02
56% of IT leaders report that their organization experiences shadow IT at least weekly[2]
03
61% of enterprises say they have unmanaged SaaS applications in their environment[3]
04
68% of organizations are concerned about shadow IT increasing their cybersecurity risk[4]
Interpretation
Shadow It Prevalence Interpretation
Shadow IT is already a frequent reality for many organizations, with 56% of IT leaders reporting it occurs at least weekly and 61% saying unmanaged SaaS applications exist in their environments.
02 · Category
SaaS & Cloud Sprawl3 stats
01
60% of enterprises reported SaaS sprawl as a top challenge (with implications including shadow IT)[5]
02
57% of respondents say unmanaged cloud services increase the risk of account takeover and credential theft[6]
03
52% of organizations say they have difficulty classifying shadow IT data for compliance purposes[1]
Interpretation
SaaS & Cloud Sprawl Interpretation
With 60% of enterprises citing SaaS sprawl as a top challenge and 57% warning that unmanaged cloud services drive account takeover and credential theft, the SaaS and Cloud Sprawl problem is clearly translating into urgent security and compliance pressure.
03 · Category
Operational Burden & Cost5 stats
01
In the Verizon DBIR 2024, 11% of breaches involved “misconfiguration/error,” commonly linked to uncontrolled tools and services[7]
02
In the Ponemon Institute / IBM study, the average cost of a breach with “third-party involvement” was $5.76 million in 2024[8]
03
In the 2024 (ISC)² study, organizations reported needing 1.5 million additional cybersecurity workers in the Asia-Pacific region alone[9]
04
In Gartner’s 2022 analysis, the average cost of a data breach rose by 2.6% year over year to reach $4.35 million[10]
05
In Gartner’s 2024 forecast, global spending on security and risk management is projected to reach $202.9 billion in 2024[10]
Interpretation
Operational Burden & Cost Interpretation
Across breach data and workforce and spending trends, operational burden is getting more expensive and harder to absorb, with misconfiguration or error showing up in 11% of Verizon DBIR breaches and breach costs tied to third parties reaching $5.76 million in 2024, while organizations also face a projected 1.5 million additional cybersecurity workers needed in Asia Pacific and rising overall security and risk management spend to $202.9 billion in 2024.
More related reading
04 · Category
Security Risk Impact1 stats
01
In the 2024 CrowdStrike Global Threat Report, 70% of ransomware victims were targeted multiple times before the attack[11]
Interpretation
Security Risk Impact Interpretation
The Security Risk Impact is heightened because 70% of ransomware victims in the 2024 CrowdStrike Global Threat Report were targeted multiple times before the attack, showing that repeated targeting is a common precursor to serious damage.
05 · Category
Governance & Controls8 stats
01
NIST SP 800-53 Rev.5 includes 4,300+ security controls total across control families (governance scope relevant to shadow IT bypass)[12]
02
CIS Controls v8 contains 18 controls and 153 sub-controls for enterprise security governance (helps standardize oversight against shadow IT)[13]
03
CIS Benchmarks include configuration guidance for 1,000+ settings for common technologies (supporting standardized enforcement)[13]
04
In 2024, the SEC required public companies to disclose material cybersecurity incidents within 4 business days (for Form 8-K triggers)[14]
05
In 2024, GDPR penalties can reach up to €20 million or 4% of annual global turnover (depending on the infringement type)[15]
06
ISO/IEC 27001:2022 specifies requirements for an information security management system (ISMS) and is structured around Annex A controls[16]
07
HIPAA requires covered entities and business associates to conduct a risk analysis of the potential risks and vulnerabilities to ePHI[17]
08
CISA defines “Managed Security Service Providers (MSSPs)” and outlines roles in the incident response ecosystem (relevant to enforcing approved tooling)[18]
Interpretation
Governance & Controls Interpretation
Governance and controls for shadow IT are tightening because frameworks and regulators increasingly demand standardized oversight at scale, from NIST SP 800-53 Rev.5’s 4,300+ controls and CIS’s 18 governance controls with 153 sub-controls to SEC reporting timelines as fast as 4 business days in 2024.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Julian Richter. (2026, February 13). Shadow It Statistics. Gitnux. https://gitnux.org/shadow-it-statistics
MLA
Julian Richter. "Shadow It Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/shadow-it-statistics.
Chicago
Julian Richter. 2026. "Shadow It Statistics." Gitnux. https://gitnux.org/shadow-it-statistics.
Sources & references
18 sources cited across this report