When the pandemic hit and offices emptied in a matter of days, IT departments scrambled to get people home with approved tools. Some companies pulled it off reasonably well. Others did not. But what happened next surprised no one who understood how the business actually ran: employees reached for the tools they’d always used anyway, the ones IT had been quietly forbidding for years.

That’s shadow IT. It’s not new. Gartner estimated that before COVID, unauthorized applications and services already accounted for 30 to 40 percent of IT spending in large enterprises. But in 2020, something shifted. The constraints that had kept shadow IT somewhat contained in offices, with IT staff watching network traffic and enforcing policy, dissolved. Employees working from home found even more reasons to ignore the tools their company officially approved.

The numbers tell the story. Shadow IT usage surged 59 percent in just the first year of the pandemic. Unauthorized remote access tools jumped 75 percent between January and March 2020 alone. Forty-two percent of employees used personal email for work without permission. Thirty-five percent turned to non-approved video conferencing platforms. Eighty-three percent of people accessed personal applications directly from their company-managed devices, according to Netskope’s 2020 research.

This wasn’t malice. It was pragmatism.

Why People Use Unauthorized Tools

Let me be direct: employees use shadow IT because approved solutions are slow, clunky, or don’t exist.

I’ve watched this play out across dozens of organizations. An employee needs a quick way to share a file with a colleague. The official system requires authentication, navigation through several menus, and takes 15 minutes to actually upload anything. Google Drive, Dropbox, or OneDrive gets the job done in 90 seconds. Which are they going to use? The choice isn’t really a choice.

Someone needs to communicate with a distributed team across time zones. Slack integrates with everything and sends notifications that actually reach people. The company’s approved platform sits unused because notifications don’t work, search is useless, and nobody checks it. So people switch.

A marketer needs to manage a project with a freelancer. Asana or Monday.com work immediately, out of the box. The internal system requires three weeks of setup time and IT approval. What happens? The work starts in an unauthorized tool, and IT finds out later.

This wasn’t a phenomenon that materialized in 2020. It was a pattern that had been accelerating for years, constrained only by the fact that most people still worked from an office where IT could enforce policy through network controls. When remote work became immediate and non-negotiable, those constraints evaporated overnight. Employees weren’t breaking rules because they were reckless. They were solving problems the way humans do when the official solution doesn’t work.

The Security Problem Is Real

But here’s what matters if you’re interested in IT security careers: this explosion of unauthorized tools creates legitimate, serious risk. It’s not theoretical. It’s infrastructure built on sand.

When 83 percent of employees are using personal applications on managed devices, you have a visibility problem. You don’t know what’s happening on your own network. You don’t know which cloud services your data is flowing through. You don’t know if someone’s access controls are configured correctly, or at all.

IBM’s cloud security team found that the average cost of a breach involving cloud misconfigurations reached $4.41 million. That’s not a typo. When employees set up shadow infrastructure without oversight, the security debt comes due eventually. Misconfigured S3 buckets. Oversharing in collaborative tools. Cloud storage accounts with weak authentication. Passwords saved in browser password managers syncing across multiple devices.

McAfee’s Work-from-Home Edition cloud report documented a massive surge in usage of unauthorized cloud tools in early 2020. The tools themselves weren’t the problem. The problem was that no one understood the risk posture. Kaspersky Lab found that 42 percent of people were using personal email for work. That’s a data loss risk, a compliance risk, and an incident response nightmare if that personal email account gets compromised.

The response from some quarters was predictable: lock it down harder. Block more tools. Enforce policies more aggressively. Add restrictions.

That approach failed before, and it would fail again.

The Old Response Doesn’t Scale

Here’s something worth understanding if you’re building a career in IT operations or security: restrictive policies create shadow IT. They don’t prevent it.

When I talk to security professionals who lived through the 2000s and 2010s, they describe IT departments that functioned almost as gatekeepers. Approval chains were long. Business needs were secondary to policy compliance. Employees learned to work around the system because the system didn’t work for them. That’s not a question of willpower or ethics. It’s what humans do.

Then the pandemic forced the issue. Suddenly, IT departments had to choose between keeping systems locked down and keeping the business running. Most chose to let people work. But they didn’t have a framework for managing the risk that came with it. They just… opened the door and hoped nothing bad happened.

Some organizations did manage it better than others. The ones that succeeded weren’t the ones that relaxed policies and called it a day. They were the ones that shifted from a blocking posture to a management posture.

Think of it this way: you can’t prevent humans from using the tools that work for them. But you can see what they’re using. You can understand the risks. You can set boundaries that don’t break the business.

The New Framework: Manage, Don’t Block

This is where career opportunities in security exploded in 2020, and the growth continues through 2021 and beyond.

The organizations that handled shadow IT effectively moved toward tools and strategies that assume shadow IT will exist, and focus on managing it instead of preventing it. Cloud Access Security Brokers, or CASBs, became central to that strategy. These tools sit between employees and cloud services, monitoring what’s happening, enforcing policies, and giving IT departments actual visibility into unauthorized tool usage.

Gartner projected that CASB adoption would triple from around 20 percent of enterprises in 2018 to 60 percent by 2022. That’s not a small shift. That’s an entire product category exploding because companies realized that the old model was broken.

At the same time, the National Institute of Standards and Technology published NIST SP 800-207, the formal framework for zero-trust architecture, in 2020. Zero trust is built on a simple principle: never trust, always verify. It assumes that the perimeter is useless. An employee working from home on their personal network, using a mix of approved and unauthorized tools? Zero trust architecture handles that. You verify every access, every request, every connection, regardless of where it’s coming from.

This is the environment that the pandemic created for IT security careers. Expertise in CASB tools became valuable. Cloud security skills were suddenly in demand. Identity and access management went from a niche specialty to a core competency. Vendor assessment and technology evaluation became critical skills because companies had to choose between dozens of tools, many of which they hadn’t even known existed before their employees started using them.

What This Means for Your Career

If you’re interested in cybersecurity or IT operations, the shadow IT explosion created several clear paths forward.

The first is cloud security. As enterprises move toward cloud-first operations and admit that they’re never going to fully control what applications their employees use, cloud security expertise becomes essential. Understanding cloud architecture, misconfigurations, identity federation, and data exposure is no longer a specialization. It’s a baseline requirement.

The second is endpoint security and management. Remote work means employees are using personal networks, personal devices, and hybrid setups that traditional network security doesn’t cover. Endpoint detection and response, mobile device management, and vulnerability assessment on distributed infrastructure are skills that companies are willing to pay for.

The third is identity and access management. If you can’t control the tools people use, you need to control who can access what. Robust identity systems, single sign-on, multi-factor authentication, and privilege access management become your actual control points.

The fourth is vendor assessment and risk evaluation. As companies adopt new tools to support remote work, they need people who can evaluate those tools, understand their risk posture, integrate them with existing systems, and set appropriate access controls. That’s a skills combination that isn’t easy to find, and companies are struggling to hire for it.

The Bigger Picture

I wrote earlier about your home network is now corporate infrastructure, because that’s the reality that the pandemic exposed. The distinction between personal and corporate computing infrastructure collapsed. When you’re working from your house, using your home network, potentially on personal devices, the boundary between those worlds becomes fiction.

That same shift applies to which tools the business runs on. The pandemic accelerated the movement toward a bring-your-own-tool environment, whether IT departments planned for it or not. Some organizations are trying to fight it. Most are learning to manage it.

The companies that are handling this well are the ones that understand what happened in those first weeks when we moved entire companies home in two weeks. It wasn’t just a temporary situation. It was a structural shift in how work happens. Remote work isn’t going away. Neither is shadow IT. The question is whether you’re going to adapt your security and IT operations strategy to that reality.

Moving Forward

Shadow IT was already everywhere. The pandemic just made it visible.

If you’re working in IT operations or cybersecurity, your job shifted in March 2020. You’re no longer maintaining a perimeter that you can defend by blocking unauthorized access. You’re managing risk in an environment where the perimeter doesn’t exist, where employees are distributed across dozens of locations on dozens of networks, and where the tools they’re using change daily.

That’s harder. It’s also more interesting, and for people with the right skills, much more valuable.

The organizations that thrive in this environment will be the ones that shift from a posture of control to a posture of visibility and managed risk. They’ll invest in technology that monitors what’s actually happening instead of trying to prevent it. They’ll build teams with cloud security expertise, identity management skills, and the ability to assess new tools quickly.

For you, that means the next few years will reward people who can work across cloud platforms, understand identity systems, evaluate risk in complex environments, and communicate security concerns to business stakeholders without being the person who says no to everything.

The old IT security model is obsolete. The new one is being built right now. The question is whether you’re going to help build it.