I've been in security in various roles for a while now and what I've found is, in companies where IT is treated as a cost centre and Security say no to stuff, S

I've been in security in various roles for a while now and what I've found is, in companies where IT is treated as a cost centre and Security say no to stuff, Shadow IT will always be rampant. If you put someone in business into the position of choosing between getting their job done/making money and adhering to a set of IT/Security rules, I can tell you which one they'll take :) How do you avoid this? Well it's not easy and it's not cheap. The most important part is ensuring that IT isn't treated like an expense, but an enabler. then you work with your business teams to make sure they have the services they need to get the job done, as safely as possible. Security teams shouldn't be blockers, but advisors. for this to work, it needs to be acknowledged that the business leaders own the risks ofc. That's massively easier to write than do, but from what I've seen of various companies, it's pretty much the only way to have a chance of doing things without huge amounts of shadow IT.