What describes a shadow IT risk in account management?

• A. Shadow IT risk is a myth.
• B. Shadow IT refers to illegal hacking activities without IT awareness.
• C. Using unsanctioned apps/services; mitigated by visibility, policy enforcement, and approved catalogs.
• D. It only involves hardware devices.

Answer: (C)

Shadow IT risk in account management comes from people using apps or services that IT hasn’t approved. When tools aren’t covered by formal provisioning and security controls, access and data can bypass standard authentication, logging, and revocation processes. That creates gaps in who can access what, where data lives, and how quickly access can be removed when someone changes roles or leaves, increasing the chances of data leakage or improper permissions.

The best description emphasizes unsanctioned apps and services and how to manage that risk: make usage visible through discovery and monitoring, enforce policies about what is allowed, and provide an approved catalog of apps and services to standardize what employees can use.

Shadow IT is not a myth, and it isn’t about illegal hacking, nor is it limited to hardware—it's about software and services used without IT oversight.