How can you shine a light on shadow IT?

A 2018 study by digital ops company PagerDuty highlighted how stressful life is for IT professionals, and this is a very real problem facing HR teams and senior IT execs everywhere.

How can businesses help manage the work/life balance of IT employees that not only have to keep systems running for hundreds of colleagues across multiple regions but then leave the office only to remain ‘on call’. Add the increasing concern of shadow IT to the mix, and your IT bods are facing burnout.

From BYOD to the IoT and Shadow IT, the pressure on IT teams continues to intensify. Employees bringing their own devices into the corporate environment, or the dawn of internet-connected devices, may be a progression of technology in the workplace. Shadow IT, however, is one stressor that needs to be examined and brought into the light.

What is shadow IT?

Shadow IT can refer to anything that is brought onto the corporate network without the knowledge of IT – from installing new web browsers or adding Slack to communicate more quickly with international colleagues – all done in the name of improving productivity but ultimately without the blessing of IT. Similarly, marketing teams may seek out bulk email systems that can offer more granularity on responses and better marketing automation.

If you have nothing to do with managing IT systems in your business, you probably won’t even have heard of shadow IT. But it’s keeping your IT teams up at night, and it’s probably not doing your business any favors either. So where’s the harm in employees trying to make the business more efficient?

Uncovering your stealth systems

How does Shadow IT come about? Mainly because once employees feel that their IT teams are failing to respond to the pace of the business and not delivering on their requirements, they’ll try and get the job done another way. In most cases, employees aren’t trying to circumvent IT but are simply wanting to meet their own deadlines and alleviate job pressures. And this is how they fall into the shady area of shadow IT deployment.

These stealth systems aren’t sanctioned by IT and can pose a huge risk to an organization. They also aren’t monitored by IT, so updates, security patches, and general management isn’t undertaken and many remain outside the corporate firewalls.

Here’s a worrying example of when shadow IT backfires on the employee. If you were one of the users that had a Dropbox account in 2012, happily storing mountains of confidential corporate information in a bid to streamline data storage for your department, you’d be having to fess up to your IT team in 2016 when Dropbox actually announced the four-year-old hack. Your harmless oversight of using unauthorized programs may have resulted in significant data theft.

Renegade marketers

And so for many marketers, the concerns around using third-party email providers to send out emails on behalf of their organization isn’t immediately apparent. It’s normal industry practice to use third-party organizations to eliminate the otherwise time-intensive task of sending and managing email campaigns. But you can quickly end up in a situation where, due to legacy systems in place and employee turnover, nobody in the company knows exactly who is sending out emails on behalf of the organization.

And you know those deliverability problems that afflict your marketing campaigns? The ones that no matter how much you tweak the email content still don’t get the deliverability and open rates you hope for? Well, that shadow IT may be to blame as, the email service providers running your campaigns may not be compliant with sender regulations, meaning your carefully-worded emails might not even be reaching your customers.

Easily authenticate your email service providers

Email protocols that can uncover and authenticate email senders are an often overlooked option for IT teams, who want to eliminate shadow IT and give marketing teams the freedom to communicate by email in a secure way. Implementing the email protocol DMARC uncovers all the email services sending email from your domain, whether you officially know about them, or not.

Matt Towell, group senior IT engineer at ADS Group faced shadow IT concerns within his organization. Once DMARC had been implemented, the landscape changed: “Using [the DMARC reports] has helped with several routing and delivery issues we had relating to SPF and DKIM records and authorized senders.”

So not only does DMARC show you exactly who’s sending emails from your domains, but it eliminates phishing attacks originating from your domain. And for those marketing teams worried about their email campaigns, it gives a failsafe on email deliverability, ensuring your brand reputation stays intact and the recipients of your emails receive legitimate emails.

Banish the shadows with OnDMARC

Sometimes the solution to a problem can be found in the most unlikely of places, and as we’ve shown here, that’s certainly true when it comes to shadow IT and DMARC. Those on the IT side of the fence can begin to take back control and secure the systems in use throughout the organization. For marketers, once the IT team knows about the services you’re using, they can help you fine-tune them and get your marketing machine running smoothly.

The DMARC protocol is key in the battle against shadow IT. To quickly check your current SPF, DKIM, and DMARC setup today, use our free investigate tool.

check email dmarc setup


Clare Holmes

26 Feb. 2018



Recent Posts


Introducing DNS Guardian: Stop impersonation and spam caused by domain takeovers 

Rahul Powar

tl;dr: We’re thrilled to announce DNS Guardian — a new feature in Red Sift OnDMARC that can swiftly identify and stop domain takeovers that lead to malicious mail. Back in February, we shared updates with the community about SubdoMailing – an attack discovered by Guardio Labs. The attack was a form of subdomain takeover,…

Read more

Navigating the Information Security Landscape: ISO 27001 vs. SOC 2

Red Sift

As cyber threats evolve, so do the standards and frameworks designed to combat them. Two of the most recognized standards in information security are ISO 27001 and SOC 2. What sets them apart, and which one is right for your organization? Let’s delve into the key differences. Purpose and Scope: Global Framework vs. Client-Centric…

Read more

G2 Summer 2024 Report: Red Sift OnDMARC’s Winning Streak Continues

Francesca Rünger-Field

We’re delighted to announce that Red Sift OnDMARC has again been named a Leader in G2’s DMARC category for Summer 2024. This recognition is based on our high Customer Satisfaction scores and strong market presence. Red Sift appeared in 11 reports – 5 new ones since Spring 2024! – earning 5 badges: A few…

Read more

Google will no longer trust Entrust certificates from October 2024

Red Sift

Tl;dr: Google has announced that as of October 31, 2024, Chrome will no longer trust certificates signed by Entrust root certificates. While there is no immediate impact on existing certificates or those issued before 31st October 2024, organizations should start reviewing their estate now. On Thursday 27th June 2024, Google announced that it had…

Read more

Understanding the domain attack

Francesca Rünger-Field

tl;dr: The recent compromise of the domain has triggered a broad-reaching web supply chain attack, impacting over 100,000 websites across various sectors including finance, healthcare, non-profits, academia, and more. To ensure the security of your website, we strongly advise you immediately remove any reference to Latest update: 27th June 2024 Sansec, a…

Read more