In today's rapidly evolving digital landscape, the phenomenon of shadow IT has become increasingly prominent, particularly in the financial services sector. This term refers to using information technology systems, devices, software, applications, and services without explicit approval from your IT department. In the digital economy, the scale, scope, and impact of shadow IT on financial institutions are changing dramatically.
The rise of shadow IT in financial services
Historically, employees in financial firms would engage with their IT departments to address their technology needs. However, the advent of cloud computing and the consumerisation of technology have transformed this dynamic. Users can now easily purchase sophisticated technology solutions without needing approval or guidance from IT. This shift has led to a significant increase in shadow IT across the financial services industry. According to Gartner, 30-40% of IT spending in large companies is now attributed to shadow IT. Furthermore, a staggering 80% of employees in financial services admit to using non-approved SaaS applications in their jobs.
This trend presents considerable risks, particularly concerning data security and compliance with regulations such as FCA, SEC, DORA, GDPR and PCI DSS. Shadow IT can be likened to a black hole, gradually siphoning information systems away from the oversight of IT departments. In fact, 61% of organisations in the financial sector have experienced a serious security incident due to shadow IT. Despite the potential dangers, many financial institutions are not actively working to eliminate shadow IT. Research indicates that those attempting to cleanse their businesses of shadow IT are in the minority. However, beneath the controversy lies a wealth of opportunity.
Understanding the drivers of shadow IT
It's essential to recognise that shadow IT is not merely the result of rogue employees intentionally flouting company policies. Instead, it often arises from genuine user needs and the pursuit of efficient solutions. For instance, in high-pressure environments like hedge funds and investment banks, the allure of easily accessible technology can overshadow the slower, more bureaucratic processes of traditional IT governance. Many users engaging in shadow IT may not even realise they are taking risks, especially when they believe they are enhancing productivity.
Shifting accountability in technology governance
A critical aspect of managing shadow IT in financial services is shifting accountability within organisations. While governance models may designate the Chief Technology Officer (CTO) as accountable for technology decisions, the reality on the ground can be quite different. With users increasingly taking matters into their own hands, it becomes clear that accountability must be shared across the organisation.
This shift requires a change in approach from IT departments. Traditionally, IT has been criticised for its binary decision-making process—responding to requests with either a "yes" or "no." This rigidity often drives users to seek their own solutions, further entrenching shadow IT. In fact, most professionals in financial services admit that they have no control over shadow IT in their organisations. To combat this, organisations need to adopt a more flexible engagement model.
A new engagement model
One innovative approach is the establishment of an early response service within the IT department. For example, when a business unit proposes a new cloud solution, the IT team can deploy a specialised group to consult during the initial stages. This team, often referred to as a SWOT team, can provide objective advice and recommendations without turning the initiative into a traditional IT project.
New tools
There are many new tools today, like Microsoft Defender for Cloud Apps, which effectively addresses shadow IT by providing visibility into all cloud applications used within an organisation, allowing IT teams to identify unauthorised apps. It assesses the risk associated with these applications, enforces data protection policies, and integrates seamlessly with existing security tools.
Harnessing shadow IT for innovation
It's important to note that not all innovation occurs within the realm of shadow IT. While the CTO may not relinquish control over critical trading technologies, financial organisations can benefit from teasing out shadow IT initiatives and transforming them into user-driven opportunities. By ensuring that the business is adequately advised and that these initiatives are transparent and compliant, companies can harness the potential of shadow IT for the greater good.
Recent statistics reveal that 57% of IT professionals in financial services have increased the number of SaaS applications managed and supported by IT in the last year to gain better control over shadow IT. Moreover, 91% of IT professionals feel pressured to compromise security while trying to enable innovation. This highlights the delicate balance organisations must strike between fostering innovation and maintaining security.
In conclusion, as the digital economy continues to evolve, so too must our understanding and management of shadow IT in financial services. By recognising the underlying needs driving this trend, shifting accountability, and fostering a collaborative approach between IT and business units, organisations can mitigate risks while unlocking new opportunities for innovation. The future of shadow IT is not one of suppression but of strategic integration, ensuring that both the business and its users can thrive in an increasingly complex digital landscape.
________________________________________
https://worldmetrics.org/shadow-it-statistics/
https://www.auvik.com/franklyit/blog/shadow-it-stats/
