#shadow-it

#shadow-it

SAMOSA is mostly focused on trying to fix "software asset management deficiencies" as well as requiring more "automation of software license management processes and incorporation of discovery tools," issues that enterprises also have to deal with. In addition, it requires anyone involved in software acquisition and development to be trained in the agency's policies and, more usefully, in negotiation of contract terms, especially those that put restrictions on software deployment and use.

How did we get here? It's simple: people want to get their work done quickly and easily. Think about the way your teams work today. They don't just use the tools the company bought; they use what's popular, what their friends recommend, or what they already know. This convenience-first mindset creates two huge, silent security gaps that most managers overlook:

Redmond has done so unilaterally, effectively endorsing "shadow IT" - the practice of bringing unapproved software and devices into the workplace. Earlier this year, Microsoft said it had adopted a new approach to shadow IT. "While earlier eras of our IT history focused on trying to prevent shadow IT, we are now concentrating on managing it," the biz said in a blog post. By "managing," Microsoft also means "enabling."

"Small and mid-sized businesses are facing a perfect storm of complexity: unknown risks living within unknown apps and AI services," said Don MacLennan, Chief Product Officer at LastPass.

Everyone's an IT decision-maker now. Employees in organizations can install plugins with one click, bypassing IT teams, impacting security posture significantly.

An AI-powered note-taker quietly syncing with your Google Drive is just one example of shadow IT that can go unnoticed and lead to significant security risks.