Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Shadow IT Is Costing Enterprises Millions
Transcript
- Lucas: There is a quiet crisis happening inside most large companies right now, and it has nothing to do with nation-state hackers or ransomware gangs. It is happening because your employees are bored, frustrated, and trying to get their actual jobs done. The problem is called shadow it, and it represents billions of dollars in unmanaged cloud subscriptions every single year. Luna: Right. So we are talking about staff signing up for external saas tools without it being tracked by the central it department? That sounds like a basic compliance nightmare waiting to happen. Lucas: Exactly. And it is not just about compliance. It is about the fact that these unauthorized applications often have terrible security protocols, no encryption standards, and absolutely no audit trails. When a company loses data through one of these channels, they cannot even say where it went. Recent estimates suggest that over fifty percent of all business software usage falls outside official it approval channels. Luna: That is a staggering number. Fifty percent means half the digital footprint is invisible to the people who are supposed to be protecting it. How does this actually translate to financial loss? Lucas: First, there is the direct cost leakage. Employees are using corporate credit cards or expense reports to pay for software that should have been negotiated centrally. We are seeing departments spend millions annually on redundant tools because nobody knew what the rest of the company was using. Second, there is the breach risk premium. Insurance underwriters are starting to flag companies with high shadow it exposure as uninsurable or requiring massive surcharges. Luna: So the insurance market is actually reacting to this? I assumed carriers were still focused purely on external attack vectors rather than internal process failures. Lucas: They are waking up to it. The logic is simple: if you cannot see the data, you cannot protect it. And if you cannot protect it, you are liable. But here is the harder part for leadership. If you simply block everything, you kill productivity. People will find another way around the firewall. They will use personal email, usb drives, whatever it takes. So the question becomes, how do you govern something you cannot easily block? Luna: This feels like the zero trust argument again. If you assume everyone is a potential threat, do you just restrict all access until proven safe? Or is there a middle ground that lets innovation happen? Lucas: It is definitely not zero trust in the strictest sense. Zero trust assumes the network is hostile. Shadow it requires a different mindset. It requires treating employees as partners rather than adversaries. The most successful organizations are moving toward a model of authorized discovery. Instead of asking employees to wait six months for an it procurement review, they create fast-track pathways for low-risk tools. Luna: Fast-track pathways? Like a pre-approved list of vetted vendors? That seems manageable. But how do they ensure those vetted tools don't become security holes themselves? Lucas: By integrating them into the central identity management system from day one. When a tool is approved, it uses the same single sign-on and multi-factor authentication as everything else. This means the it team can monitor usage, enforce password policies, and revoke access instantly if the employee leaves. The key is removing the friction that caused the shadow it in the first place. Luna: So the root cause is usually bureaucratic delay? If it takes too long to get permission, people just go rogue. That makes sense. But what about the data itself? Once that data is in a third-party cloud, isn't it gone? Lucas: Not necessarily, provided the vendor meets certain standards. The real danger is when data ends up in consumer-grade apps that have no enterprise SLA. Think about a marketing team storing customer lists in a public spreadsheet app that anyone with the link can view. That is not a complex hack. That is just negligence enabled by lack of oversight. Luna: Public spreadsheets. Yeah, I have seen that happen. It is embarrassing but also incredibly common. Do companies have any technical way to detect this before it becomes a headline? Lucas: Yes, through cloud access security brokers, or CASB. These sit between the corporate network and the cloud services. They can identify when an employee is accessing unapproved applications based on domain names, traffic patterns, or data types. Some advanced systems can even flag when sensitive keywords like social security numbers or credit card data appear in documents being uploaded to unknown sites. Luna: That sounds powerful. But doesn't monitoring employee internet usage raise huge privacy concerns internally? Workers might push back hard against that level of scrutiny. Lucas: It is a valid concern. The trick is transparency. You have to tell employees exactly what is being monitored and why. It should be framed as protecting company data, not spying on individual behavior. Most people understand that if they are using corporate devices for work purposes, some level of oversight is expected. The backlash usually comes when the rules are opaque. Luna: Transparency changes the dynamic completely. It shifts it from policing to partnership. But let's talk about the financial side again. For a CFO, how do you quantify the return on investment for fixing shadow it? It feels like an operational fix rather than a revenue driver. Lucas: It is both. On the cost side, you eliminate duplicate software licenses. If five different teams are paying for project management tools, consolidating those into one enterprise contract saves massive amounts. On the revenue side, faster approval cycles mean products get to market quicker. Security should be an enabler, not a bottleneck. When it works well, it accelerates business. Luna: I like that framing. Enabler instead of bottleneck. That is the language executives respond to. But is this a problem that gets worse during economic downturns when companies cut it budgets? Lucas: Absolutely. When it resources are slashed, response times for approvals slow down. Frustration rises. And shadow it explodes. It is ironic that cutting the budget to prevent risk actually increases the risk. Companies that maintain strong governance structures during tight quarters tend to come out stronger because their processes are already streamlined. Luna: So resilience is built on having good habits during the boom years, not panic-buying controls during the bust. That aligns with what we discussed last time about cybersecurity debt. Lucas: Precisely. Shadow it is a form of cybersecurity debt. Every unauthorized app is a loan that eventually comes due. And the interest rate is measured in compliance fines, brand damage, and lost customer trust. Paying it down early is cheaper than facing the consequences later. Luna: Before we dig deeper into the technical implementation of these CASB tools, I want to pause and mention something about how this show operates. Lucas: Sure. What is on your mind? Luna: Just a quick honest thing. A handful of listeners chip in monthly through buy me a coffee dot com slash fexingo, and that is literally what funds making this many of these episodes possible. Lucas: Yeah, and it keeps us independent. No ads, no sponsors dictating the topics. Just us digging into the stuff that matters to operators and builders. If you find value in these conversations, consider joining that small group of supporters. Luna: It really helps keep the quality high and allows us to take risks on deeper dives like this one. Thanks for listening, and let's get back to the data. Lucas: Let's look at the technical architecture. When a company implements a CASB solution, what does the user experience actually look like? Do they notice anything different? Luna: Ideally, nothing. It should be invisible. If users have to change how they log in or remember extra steps, adoption will fail. The magic is in the background enforcement. Lucas: Correct. The ideal state is seamless integration. Users click a link, authenticate via the corporate portal, and access the tool. If they try to access an unapproved site, they might see a warning page explaining why it is blocked, along with a button to request temporary access. That feedback loop is critical. Luna: The request button is smart. It turns a 'no' into a process. It gives the employee agency and gives it the data they need to evaluate new tools. It stops being a game of cat and mouse. Lucas: Exactly. It creates a culture of accountability. Employees learn which tools are safe and which are risky. Over time, the volume of shadow it drops because people start self-selecting approved options. It is behavioral change driven by convenience and clarity. Luna: And that reduces the attack surface significantly. Fewer entry points mean fewer opportunities for bad actors. But what about legacy systems? Large enterprises often have old infrastructure that cannot integrate with modern CASBs easily. Lucas: That is the hardest part. Legacy mainframes or older ERP systems may not support modern authentication protocols. In those cases, companies often use proxy solutions or gateway filters. It is less elegant, but it provides a layer of protection while they plan a gradual migration to cloud-native architectures. Luna: Migration is always a multi-year journey. It is frustrating for leadership who wants immediate results. How do you sell a ten-year roadmap to a board that cares about quarterly earnings? Lucas: You tie it to risk reduction metrics. Show them the cost of potential breaches versus the cost of migration. Use industry benchmarks to demonstrate competitive advantage. Companies with modern, secure stacks attract better talent and more cautious clients. It is a strategic asset, not just an it expense. Luna: Talent attraction is a strong lever. Younger workers expect seamless digital experiences. If the internal tools are clunky and insecure, they leave. So security is directly linked to retention. Lucas: Without a doubt. The best security program is one that enables the work to flow smoothly. When it works, nobody notices. When it fails, everyone suffers. The goal is invisibility with ironclad protection behind the scenes. Luna: Invisibility with protection. That is the gold standard. As we wrap up, what is the one action a mid-sized company can take tomorrow to start reducing shadow it? Lucas: Conduct a transparent survey. Ask teams what tools they are using and why. Listen without judgment. Then prioritize creating fast-track approvals for the most popular unapproved tools. Start solving the problem at its source. Luna: Listen first, then act. Simple advice, but it addresses the human element that so many tech strategies ignore. Thanks for breaking this down, Lucas. Lucas: Thanks, Luna. It is a reminder that security is ultimately about people, processes, and trust. Keep watching how that balance evolves in the coming year.