TL;DR
Shadow IT in hardware almost never starts with somebody trying to break a rule. It starts with a person who needed something, found the official route slow or closed, and solved their own problem. Treating that as misbehaviour makes it invisible rather than making it stop, and invisible is the expensive version.
- It is nearly always a speed problem, not a compliance one.
- The risk is not the device. It is that company data is now somewhere you cannot see.
- A crackdown moves it underground. Amnesty plus a faster route works better.
- The commonest cause is an approval that took longer than a credit card.
- Count it before you judge it. Expense claims are the easiest place to look.
- Some of it is a signal that your standard kit is wrong for a group of people.
Why shadow IT hardware appears
Ask the people who did it and you get the same handful of answers.
The request would have taken two weeks and the work was due Thursday. The approver was away. The standard machine could not run the thing they needed. They asked once, got no reply, and stopped asking.
None of those is a character flaw. Each is a process telling somebody that the unofficial route is faster, and people respond to that the way anybody would.
The second cause, which is harder to admit
Sometimes the official kit is simply wrong for a group of people, and nobody has reviewed it since the company was a third of its current size.
When a whole team quietly buys the same accessory, that is not a discipline problem. It is a specification gap with a clear signal attached, and the useful response is to update the standard rather than to chase the purchases.
Teams that treat every instance as rule breaking miss that signal entirely, and keep buying equipment that half the company works around.
What shadow IT devices actually risk
Disclosure: RemoAsset, named below, is owned by the same people who publish PeopleOpsHQ. It is described with its limitations stated, on the same terms as every other supplier. This site takes no vendor money.
Being precise matters here, because overstating it makes people stop listening and understating it leaves a real gap.
The device itself is rarely the issue. A personal laptop is not inherently insecure, and plenty are better maintained than company machines.
The risk is that company data has moved somewhere with no visibility and no exit plan.
| What is lost | Why it matters |
|---|---|
| Encryption state | You cannot evidence it, so you must assume the worst |
| Patch status | No way to know, no way to enforce |
| Offboarding | Nothing to collect, nothing to wipe |
| Incident response | Cannot isolate a device you do not know exists |
| Data subject requests | Cannot search what you cannot see |
That last row catches people out. Where a request arrives under frameworks such as the consolidated text of the General Data Protection Regulation, the obligation attaches to the data rather than to the hardware it happens to sit on, so a personal device holding company records is squarely in scope.
Equally, management standards such as ISO/IEC 27001, the information security management standard expect the asset inventory to be accurate. A fleet with an unknown number of unlisted devices cannot evidence that control, whatever the devices themselves are like.
Count it before you judge it
Most companies have no idea of the scale, which makes the response either an overreaction or nothing at all.
Four places to look, none of which requires a tool.
- Expense claims. Equipment appearing on expenses is the clearest signal, and it is already in a system somebody can query.
- Support tickets. People asking for help with a device that is not in the register tell you a great deal.
- Login records. Device names in your identity provider that nobody recognises.
- Ask. Genuinely. Framed as a survey about whether people have what they need, not as an audit.
The fourth works better than people expect, because most of this was never hidden. It just was not reported, as nobody asked.
What the number tells you
A handful of cases is individual circumstances. A pattern concentrated in one team is a specification or process problem in that team. Spread evenly across the company, it is your request process.
Those three findings lead to three completely different responses, which is why counting first matters more than acting quickly.
Closing the gap without a crackdown
Enforcement first is the instinct and it reliably fails. People do not stop solving their problems; they stop telling you how.
The sequence that works has three parts and takes about a quarter.
Amnesty. A stated window where anybody can register a device or hand it back with no consequence. Say plainly that nothing happens to anyone who comes forward, and mean it, because the first person who is punished ends the amnesty for everybody.
Fix the speed. Whatever the counting exercise showed. Usually that is a same day approval commitment for standard items and a named deputy for every approver.
Then set the rule. Once the official route is genuinely faster, a clear policy is reasonable and enforceable. Before that, it is a rule people cannot follow and will resent.
What to do with the devices that come back
Two situations. A personal device holding company data needs that data removed, which is a conversation rather than a technical action because it is somebody’s own property.
A company-funded device bought outside the process needs bringing into the register, enrolling, and treating as normal from that point. Where it was bought on expenses, somebody should check the specification matches what the person actually needed, since that is often why it was bought that way.
Where machines are being collected or replaced as part of this, they still need proper handling at end of life rather than being quietly reused. NIST Special Publication 800-88 on media sanitization is the standard most disposal contracts name, and a device that entered the fleet informally should leave it formally.
The decision table
| Situation | Scale | Setup | Primary pain | Recommended starting point |
|---|---|---|---|---|
| Suspect it, no data | Any | No visibility | Cannot size it | Check expense claims first |
| Concentrated in one team | Any | Standard kit for all | Specification gap | Review that team’s requirements |
| Spread across the company | 50 to 200 | Slow approvals | Process is the cause | Fix turnaround before any rule |
| Personal devices holding data | Any | No MDM on them | No visibility or exit | Amnesty, then company kit offered |
| Found during an audit | Any | Questionnaire pressure | Cannot evidence inventory | Register what exists, then remediate |
Keeping the gap closed
Amnesties work once. What keeps the number near zero afterwards is that the official route stays faster than the unofficial one, and that takes maintenance.
Three habits do most of it.
Watch the turnaround, not the policy. Measure how long requests actually take, monthly. When it drifts past a few days, shadow purchasing starts again, and it will show up in expenses before it shows up anywhere else.
Review the standard kit annually against complaints. Not against what the market offers. Against what people keep asking for and keep being refused, because that list is your specification gap written out.
Make returning easy. A lot of informal equipment persists simply because handing it back is awkward and nobody has made it simple.
That last point is where logistics help. Where collection comes with packaging and a booked courier, people return things; where it means finding a box and queuing at a post office, they do not. A retrieval service that arranges packaging and collection is the mechanism, and the honest caveat is that it does nothing about devices you have not identified yet. Counting still comes first.
For the adjacent question of what to do when people buy kit and claim it back, see our guide to expensing your own equipment.
See how collection is made easy enough that people actually return things at device retrieval with packaging arranged, or read our guide to expensing your own equipment.
Frequently asked questions
What causes shadow IT in hardware?
Speed, almost always. The request would have taken two weeks and the work was due Thursday, or the approver was away, or somebody asked once and got no reply. A smaller but important cause is that the standard kit genuinely does not fit a group of people and nobody has reviewed it since the company was much smaller. Neither is a discipline problem, and treating them as one hides the signal.
Is a personal laptop actually a security risk?
The device usually is not, and plenty are better maintained than company machines. The risk is that company data now sits somewhere with no visibility and no exit plan. You cannot evidence its encryption, enforce patching, collect it when the person leaves, isolate it during an incident, or search it when a data request arrives. The gap is in what you can see, not in the hardware.
How do we find out how much shadow IT we have?
Four places, none needing a tool. Expense claims, where equipment purchases are the clearest signal and already sit in a queryable system. Support tickets mentioning devices not in the register. Unrecognised device names in your identity provider. And asking directly, framed as a survey about whether people have what they need rather than as an audit, which works better than most expect.
Should we ban personal devices outright?
Not as a first move, because enforcement before the official route is fast simply pushes the behaviour underground. People do not stop solving their problems, they stop telling you how. Run an amnesty, fix whatever the counting showed was slow, and set the rule once the proper route genuinely beats a personal credit card. Then it is both reasonable and enforceable.
What does the pattern tell us?
Three different things needing three different responses. A handful of cases is individual circumstances. A cluster inside one team is a specification or process problem specific to that team. Spread evenly across the company, it is your request process. Counting first is what lets you tell them apart, which is why acting before measuring usually fixes the wrong thing.
How do we handle a personal device holding company data?
As a conversation rather than a technical action, because it is somebody’s own property and you cannot simply wipe it. Agree what needs removing and how, and offer company equipment so the underlying need is met. A company funded device bought outside the process is simpler: bring it into the register, enrol it, and check whether its specification reveals why the official kit was avoided.
How do we stop it returning?
Measure request turnaround monthly rather than relying on the policy, because when it drifts past a few days the behaviour restarts and shows up in expenses first. Review the standard kit each year against what people keep asking for and being refused. And make returning equipment genuinely easy, since a lot of informal kit persists only because handing it back is awkward.
PeopleOpsHQ covers the operational side of distributed work. We describe suppliers with their limitations stated, and we take no vendor money.
