What Leaders Can Do When Shadow IT Appears
- Joel Larson, PhD
- Dec 23, 2025
- 3 min read
Shadow IT often enters the conversation only after it has already gained momentum.
A system shows up on the network.
A department quietly renews a contract.
Someone asks IT for support for a tool the institution has never heard of.
By the time this happens, the instinct is often corrective: tighten the rules, reinforce policy, or bring out the checklist.
But in my doctoral research with CIOs and CISOs at U.S. public R1 institutions, the leaders who consistently improved their Shadow IT landscape didn’t start with correction.
They started with curiosity.
Because Shadow IT is not the cause.
It is the evidence.
The evidence of unmet need.
The evidence of innovation pressure.
The evidence of misalignment between governance and reality.
And when leaders approach Shadow IT through that lens, the outcome changes completely.
1. Begin with Curiosity, Not Correction
A surprising number of Shadow IT decisions are driven by urgency — not defiance.
A faculty member trying to meet an accreditation requirement.
A research team racing toward grant deadlines.
An advising center trying to close student equity gaps before the next reporting cycle.
When those individuals adopt an unapproved tool, the first productive question is not:
“Why did you go around IT?”
The more meaningful question is:
“What need made this the best or only option at the time?”
This question opens doors, reduces defensiveness, and uncovers the pressures that governance structures often miss.
If the goal is alignment rather than discipline, curiosity is the only viable starting point.
2. Make IT Easy to Engage
Many of the CIOs and CISOs I interviewed noted a consistent theme:
Shadow IT frequently occurred because people didn’t know how to engage IT effectively — or didn’t believe engagement would help.
Not because IT teams were unwilling
But because the institution had not made the path clear.
Common challenges included:
unclear intake processes
ambiguous timelines
no visibility into decision pathways
inconsistent expectations between units and IT
confusion about who owns which service
Central IT can’t eliminate urgency, but it can eliminate uncertainty.
Clearer processes reduce anxiety.
Transparent timelines reduce assumptions.Shared vocabulary reduces miscommunication.
When IT becomes predictable, it becomes approachable.
And when it becomes approachable, people stop looking for ways around it.
3. Share Decision-Making, Don’t Centralize It
Governance is strongest when it is shared.
Not because it distributes labor,
but because shared governance distributes understanding.
Academic units understand instructional needs.
Administrative offices understand workflow realities.
Researchers understand compliance pressure and funding cycles.
IT understands risk, data, integration, and support implications.
When these perspectives meet, governance becomes not a gate, but a conversation about trade-offs.
The most effective CIOs created governance structures that allowed decisions to be made with the institution — not for it.
This shift transforms Shadow IT from a compliance problem into a partnership opportunity.
4. Redefine IT’s Identity: From the Department of “No” to the Department of “Know”
One of the unspoken drivers of Shadow IT is perception.
If people believe the answer will be “no,”
they stop asking the question.
But institutions that reduce Shadow IT the most do something different:
they reposition IT as the department of know.
Know the pressures.
Know the constraints.
Know the goals.
Know the pathways forward.
Know the trade-offs.
Know how to help people succeed.
This framing signals that IT is not merely an arbiter of compliance —IT is a partner in institutional mission.
When IT becomes the department of know, Shadow IT becomes a conversation instead of a surprise.
And trust becomes the foundation for every future collaboration.
Shadow IT as a Leadership Moment
Shadow IT is not eliminated through force.
It is reduced through understanding.
When leaders start with curiosity, remove barriers to engagement, share decision-making, and shift the narrative around IT’s identity, Shadow IT becomes a visible map of institutional needs — not a list of violations.
This is the turning point for the entire series:
Shadow IT isn’t about rule-breaking.
It’s about unmet needs and misaligned perceptions.
Understanding why Shadow IT happens is essential to understanding how to respond — and that brings us to the final post.
Coming Next: The Framework Behind All of This
In Post 5, we look at the model that explains everything happening beneath the surface:
Technology Threat Avoidance Theory (TTAT).
It is the framework that ties together:
trust
innovation pressure
perceived barriers
risk perception
coping behavior
decision-making under urgency
It is the mechanism that predicts how and why Shadow IT emerges — and how leaders can prevent it through alignment, not enforcement.
Comments