Shadow IT

In spring 2024, Mandiant notified about 165 organizations that their Snowflake customer accounts had been accessed with stolen credentials; Ticketmaster, AT&T and Santander were among them. The platform itself had not been breached. The attackers walked into accounts that had no multi-factor authentication, using passwords harvested by infostealers, sometimes years earlier, including on contractors' machines. The case shows what shadow IT costs: a cloud account the security team does not manage, and so one that misses the rules it enforces elsewhere. The term covers tools, apps and SaaS accounts that teams use outside IT's control. Typical cases are a file-sharing space set up by a salesperson, a cloud database paid for on a company card, or an e-signature tool wired into email. The intent is rarely malicious. The result is an asset nobody inventories, patches or monitors, and where the authentication policy does not apply. For an insurer, the flaw is one of method: the application describes the declared environment, not the one teams actually use. An answer of MFA on all remote access is honest for the tools IT knows about. Attack surface scans and external security ratings close part of the gap (domains, subdomains, exposed services), while SaaS accounts opened under a company email address largely escape them. At claim time, the gap between what was declared and what was running opens a discussion about the representations in the application. It is rarely easy to settle when the insured did not know about the tool either. Not to be confused with shadow AI, the use of generative AI assistants outside company policy: it is a recent variant with a risk of its own, leakage through what employees type in.