Shedding Light on Shadow IT

Paulo Rosado, Founder & CEO, OutSystems | 1/12/2011 | 8 comments

Paulo Rosado
IT spending, especially among business units, has been a heated topic at every organization I've ever worked with. Projects that division managers consider high-priority aren't regarded highly by corporate IT, or, worse, are completely ignored by IT. This, in turn, drives these managers to other means to accomplish their IT goals -- what I like to call "Shadow IT."

While the term sounds super-sexy, it really isn't. Shadow IT simply refers to projects implemented by business units without the support (and sometimes without the awareness) of the larger corporate IT structure. It's a very real problem for any organization operating at the enterprise level. Forrester Research Inc. estimates that as much as 15 percent of an enterprise IT budget is spent in shadow IT projects -- usually without the CIO's knowledge.

Here's how I've seen shadow IT typically evolve. First, the pressure for business growth and transformation makes IT staff say "Leave me alone" until a large IT project (like an ERP implementation) is finally completed. Business units are now on their own to procure and deploy their solutions. While not a true IT free-for-all, this results in some fairly significant downsides for the business as a whole, including:

  • Limited systems integration
  • Redundant functions across various business units
  • Orphaned custom code and applications

Once corporate IT pulls its head out of the proverbial sand, it's left with a maintenance nightmare. This results in the next step of the Shadow IT evolution -- "The Iron Fist." At this point corporate IT calls in enterprise architects to clean up the mess created by the business units' pet projects. Then it lays down the law, requiring that all software development and application purchases be procured and delivered by the corporate IT team. In addition, it erects stringent guidelines around architecture and standards.

The Iron Fist rationale is based on the notion that when we are done we will have a tremendously flexible, well designed corporate architecture that can respond to new requirements really quickly. The problem is that until we reach this nirvana, the business keeps piling on requests, which take forever to get delivered.

I have seen VPs cry with despair while they wait for relatively small portal changes that would increase revenue by millions if only they didn't get delayed year after year while the new SOA architecture is being deployed. These are the VPs who swallow it up and wait. More aggressive VPs start up truly rogue IT projects, which -- while meeting their business needs -- do not conform to any corporate policies or standards. This results in sheer technology-based chaos and the proliferation of truly disconnected "mushroom" applications.

So how do you break this vicious cycle? Until recently there was no obvious way out of this dilemma. If you wanted flexibility you gave up control. However, a new way of doing things, based on an upcoming generation of cloud-ready platforms, holds promise. With these platforms you can implement a federated model of enterprise software development, where IT pushes the specs gathering and initial application development to the business units. This eases the burden of managing every single new project, allowing the IT department to maintain centralized control on security, global enterprise architecture, and operations, through a standard cloud infrastructure definition.

You can expect some of these applications to grow rapidly and become strategic for the enterprise, because software should change at the speed of the business it supports. When this occurs, an advantage of the federated model is that IT can smoothly take over the maintenance of the apps that are becoming strategic, without having to rewrite them and stopping the flow of change.

This approach makes it easy for corporate IT to foster development at the local level, while still exercising governance and control over these projects. An example might be IT making the same centralized service available to all business units and encouraging their development teams to reuse this service for themselves.

In the end, the federated model doesn't really end shadow IT -- it legitimizes it and brings it into lockstep with the rest of the IT process. In essence it keeps IT in sync with the business. Individual business units feel their needs are being met, while corporate IT retains the governance and control it needs to keep the business running smoothly.

Or, to say it another way: You can take IT out of the shadows by moving it into the cloud.

View Comments: Newest First | Oldest First | Threaded View
Terry Sweeney   Shedding Light on Shadow IT   1/13/2011 11:41:53 AM
Re: Punch Out the Iron Fist
Thanks for your reply, Paulo. As you describe it, I see cloud easing the transition of rogue projects (once discovered) into the corporate fold. I still don't see cloud services making anyone think twice about launching their own unathorized apps, servers, WiFi nets, etc.
PauloRosado   Shedding Light on Shadow IT   1/13/2011 7:23:02 AM
Re: Punch Out the Iron Fist
Terry, you are absolutely right. The dynamics of the business wanting a constant stream of changes that they tend to reflect in apps will always be there. The difference with a  cloud-based platform is that instead of having the business building it on its own in Microsoft Access or Sharepoint and creating an isolated mushroom (and a future maintenance nightmare), that app now is built on a centralized platform where you as IT can look into it, control it and take over. The dynamics that change are the ones that happen if the app becomes strategic. In that case the move from Shadow to Central IT can be done more smoothly without having to rewrite the whole thing.
PauloRosado   Shedding Light on Shadow IT   1/13/2011 7:21:35 AM
Re: Decentralized IT
David, thank you for the comment. I have seen it being done in 3 ways. The first model is to have a SWAT team inside central IT that moves around and goes to the business, builds something, puts into production and moves on. The other model that works for bigger business units is to have a shadow team that reports to the VP and has a dotted line to the IT. The third model is a combination of both. Small project teams either Shadow or SWAT are complemented by Central IT Core teams that create the Services and architectural foundations for the others to work on top.
CurtisFranklin   Shedding Light on Shadow IT   1/12/2011 10:43:09 PM
RE: Shedding Light on Shadow IT
The problem isn't which method is better but more so, why are you trying to cram a single control down the throat of all of your IT teams.  Even within IT, different teams have different needs and require different level of flexibility.  Understanding your business is the first step.

I dunno, @SC, if you keep talking sense like that you're going to get into real trouble. The problem we're facing now is the IT department that decides control and restriction are the answers to the challenges of a complex world. When an IT organization can get a handle on the proper balance between flexibility and control, it will be on the way to returning real value back to the enterprise.

sechristiansen   Shedding Light on Shadow IT   1/12/2011 8:37:34 PM
RE: Shedding Light on Shadow IT
I have personally experienced both sides of this paradox.  One the one side I have seen cowboy IT staff do what they will, especially in branch locations, which makes consistency, support and ultimately future flexibility a very straining task.

Now on the other side of the field, I have also witnessed large IT organizations which have ingrained a somewhat necessary red tape to help keep all of their projects under control, however this process also impedes the speed of business.

So which method is better?  The problem isn't which method is better but more so, why are you trying to cram a single control down the throat of all of your IT teams.  Even within IT, different teams have different needs and require different level of flexibility.  Understanding your business is the first step.

Terry Sweeney   Shedding Light on Shadow IT   1/12/2011 12:58:31 PM
Re: Punch Out the Iron Fist
I agree with Sara... this is an incredibly important -- and underreported -- phenomenon. But isn't it a little glib to push the solution off on the cloud and the hope that a more federated approach will cut these rogues off at the pass?

That may work in some instances, but I don't see it changing the dynamic that leads to this sort of out-of-channel behavior in the short or long term.
David Wagner   Shedding Light on Shadow IT   1/12/2011 12:55:59 PM
Decentralized IT
Great post, Paulo. I think you've really hit on an excellent solution for this problem.

Projecting forward quite a lot, I'm wondering how this would change the IT department. If cloud computing and SaaS allows for the business to do more of the workload and eliminate large projects, would it make sense to transfer memebers of the IT department to different divisions of the enterprise rather than keep them in a centralized department?

Perhaps, the future lies in a department that runs what is left of the data center and private cloud, and everything else gets transfered out? This might allow for better tracking of IT costs and give more direct service to business critical functions.

Obviously, some companies follow some aspect of this model already to more or less of a degree.  Do you see this as a potential change or am I overestimating the impact?
Sara Peters   Shedding Light on Shadow IT   1/12/2011 12:33:04 PM
Punch Out the Iron Fist
Thank you, Paulo. This is a huge issue that I think very few enterprises get right. Ultimately IT is there to support the business. Sometimes that means that you need to protect the business from itself -- which is why security admins give users fewer access privilieges -- but sometimes you need to support the business by giving it free rein. That balance is hard to strike. 

The blogs and comments posted on do not reflect the views of TechWeb,, or its sponsors., TechWeb, and its sponsors do not assume responsibility for any comments, claims, or opinions made by authors and bloggers. They are no substitute for your own research and should not be relied upon for trading or any other purpose.

More Blogs from Paulo Rosado
Paulo Rosado   9/22/2011   3 comments
The cloud is often portrayed as a cure-all aiding enterprises with everything from infrastructure to development -- and for good reason. Cloud services offer unprecedented flexibility, ...
Paulo Rosado   4/12/2011   11 comments
The late 80s and early 90s are famous for many things: Mideast turmoil, incredibly bad hair, terrible choices in music, and, most importantly, the client-server application model.
Paulo Rosado   10/18/2010   17 comments
For the past decade, I've seen almost every industry embrace efficiency, from robotic assembly lines in manufacturing and electronic medical records in healthcare to "one-click" e-commerce ...
Latest Archived Broadcast
We talk with Bernard Golden about accelerating application delivery in the cloud.
On-demand Video with Chat
Register for this video discussion to learn how tablets can provide true business usability and productivity.
E2 IT Migration Zones
IT Migration Zone - UK
Why PowerShell Is Important
Reduce the Windows 8 Footprint for VDI
Rethinking Storage Management
IT Migration Zone - FR
SQL Server : 240 To de mémoire flash pour votre data warehouse
Quand Office vient booster les revenus Cloud et Android de Microsoft
Windows Phone : Nokia veut davantage d'applications (et les utilisateurs aussi)
IT Migration Zone - DE
Cloud Computing: Warum Unternehmen trotz NSA auf die „private“ Wolke setzen sollten
Cloud Computing bleibt Wachstumsmarkt – Windows Azure ist Vorreiter
Like Us on Facebook
Twitter Feed
Enterprise Efficiency Twitter Feed
Site Moderators Wanted
Enterprise Efficiency is looking for engaged readers to moderate the message boards on this site. Engage in high-IQ conversations with IT industry leaders; earn kudos and perks. Interested? E-mail:
[email protected]
Dell's Efficiency Modeling Tool
The major problem facing the CIO is how to measure the effectiveness of the IT department. Learn how Dell’s Efficiency Modeling Tool gives the CIO two clear, powerful numbers: Efficiency Quotient and Impact Quotient. These numbers can be transforma¬tive not only to the department, but to the entire enterprise.

Read the full report
The State of Enterprise Efficiency in the Virtual Era: Virtualization – Smart Approaches to Maximize Gains
Virtualization is a presence in nearly all enterprise data centers. But not all companies are using it to its best effect. Learn the common characteristics of success, what barriers companies face, and how to get the most from your efforts.

Read the full report
Informed CIO: Dollars & Sense: Virtual Desktop Infrastructure
Cut through the VDI hype and get the full picture -- including ROI and the impact on your Data Center -- to make an informed decision about your virtual desktop infrastructure deployments.

Read the full report
A Video Case Study – Translational Genomics Research Institute
e2 Video

On the Case
TGen IT: Where We're Going Next

7|11|12   |   08:12   |   10 comments

Now that TGen has broken new ground in genomic research by using Dell's storage, cloud, and high-performance computing solutions, the company discusses what will come next for it and for personalized medicine.
On the Case
Better Care Through Better Communications

6|6|12   |   02:24   |   11 comments

The achievements of the TGen/Dell project could improve how all people receive healthcare, because they are creating ways to improve end-to-end communication of medical data.
On the Case
TGen IT: Where We Are Now

5|15|12   |   06:58   |   6 comments

TGen is breaking new ground in genomic research by using Dell's storage, cloud, and high-performance computing solutions.
On the Case
TGen IT: Where We Were

4|27|12   |   06:45   |   10 comments

The Translational Genomics Research Institute wanted to save lives, but its efforts were hobbled by immense computing challenges related to collecting, processing, sharing, and storing enormous amounts of data.
On the Case
1,200% Faster

4|18|12   |   02:27   |   12 comments

Through their partnership, Dell and TGen have increased the speed of TGen’s medical research by 1,200 percent.
On the Case
IT May Improve Children's Chances of Survival

4|17|12   |   02:12   |   8 comments

IT is helping medical researchers reach breakthroughs in a way and pace never seen before.
On the Case
Medical Advances in the Cloud

4|10|12   |   1:25   |   5 comments

TGen and Dell are pushing the boundaries of computing, and harnessing the power of the cloud to improve healthcare.
On the Case
TGen: Living the Mission

4|9|12   |   2:25   |   3 comments

TGen's CIO puts the organizational mission at the heart of everything the IT staff does.
On the Case
TGen Speeding Up Biomedical Research to Save More Lives

4|5|12   |   1:59   |   6 comments

The Translational Genomics Research Institute is revamping its computing to improve speed, storage, and collaboration – and, most importantly, to save lives.
On the Case
Computing Power Helping to Save Children's Lives

3|28|12   |   2:13   |   3 comments

The Translational Genomics Institute’s partnership with Dell is enabling them to treat kids with neuroblastoma more quickly and save more lives.
Tom Nolle
The Big Reason to Use Office

3|18|14   |   02:24   |   46 comments

Office and personal productivity tools come in a first-class and coach flavor set, but what makes the difference is primarily little things that most users won't encounter. What's the big issue in using something other than Office, and can you get around it?
E2 Editors
SPONSORED: Mobile Security — A Use Case

3|4|14   |   04:27   |   16 comments

New mobile security solutions can accommodate a wide array of needs, including those of a complex university environment.
Tom Nolle
Killing Net Neutrality Might Save You Money

1|16|14   |   2:13   |   16 comments

The DC Court of Appeals voided most of the Neutrality Order, and whatever it might mean for the Internet overall, it might mean better and cheaper Internet VPNs for businesses.
Tom Nolle
The Internet of Everythinguseful

1|10|14   |   2:18   |   19 comments

We really don't want an "Internet of Everything" but even building an Internet of Everythinguseful means setting some ground rules to insure there's value in the process and that costs and risks are minimized.
Tom Nolle
Maturing Google Chrome

12|30|13   |   2.18   |   25 comments

Google's Chrome OS has a lot of potential value and a lot of recent press, but it still needs something to make it more than a thin client. It needs cloud integration, it needs extended APIs via web services, and it needs to suck it up and support a hard drive.
Sara Peters
No More Cookie-Cutter IT

12|23|13   |   03.58   |   21 comments

Creating the right combination of technology, people, and processes for your IT organization is a lot like baking Christmas cookies.
Sara Peters
Smart Wigs Not a Smart Idea

12|5|13   |   3:01   |   46 comments

Sony is seeking a patent for wigs that contain computing devices.
Tom Nolle
Cloud in the Wild

12|4|13   |   02:23   |   15 comments

On a recent African trip I saw examples of the value of the cloud in developing nations, for educational and community development programs. We could build on this, but not only in developing economies, because these same programs are often under-supported even in first-world countries.
E2 Editors
SPONSORED: Is Malware Evading Your IPS?

11|18|13   |   03:16   |   4 comments

Intrusion prevention software is supposed to detect and block malware intrusions, but clever malware authors can evade your IPS in these five main ways.
Sara Peters
Where Have All the Mentors Gone?

9|27|13   |   3:15   |   38 comments

A good professional mentor can change your life for the better... but where do you find one?
Tom Nolle
SDN Wars & You Could Win

9|17|13   |   2:10   |   5 comments

VMware's debate with Cisco on SDN might finally create a fusion between an SDN view that's all about software and another that's all about network equipment. That would be good for every enterprise considering the cloud and SDN.
Ivan Schneider
The Future of the Smart Watch

9|12|13   |   3:19   |   39 comments

Wearing a bulky, oversized watch is good training for the next phase in wristwatches: the Internet-enabled, connected watch. Why the smartphone-tethered connected watch makes sense, plus Ivan demos an entirely new concept for the "smart watch."
Tom Nolle
Cutting Your Cloud Storage Costs

9|4|13   |   2:06   |   3 comments

Cloud storage costs are determined primarily by the rate at which files are changed and the possibility of concurrent access/update. If you can structure your storage use to optimize these factors you can cut costs, perhaps to zero.
Sara Peters
Do CIOs Need an IT Background?

8|29|13   |   2:11   |   23 comments

Most of the CIOs interviewed in the How to Become a CIO series did not start their careers as IT professionals. So is an IT background essential?
Ivan Schneider
The Internet Loves Birthdays

8|27|13   |   3:25   |   69 comments

The Internet has evolved into a machine for drumming up a chorus of "Happy Birthday" messages, from family, friends, friends of friends who you added on Facebook, random people that you circled on G+, and increasingly, automated bots. Enough already.