BYOD and shadow IT

BYOD refers to the practice of employees using personal devices to access company systems. The device is personal; the access is to company resources. Most companies with a BYOD program have some form of mobile device management or conditional access policy that governs how those devices connect.

Shadow IT enters through BYOD in a specific way: personal devices are where employees are most likely to use personal accounts for work tasks, install browser extensions without an IT review, and run AI tools in a personal profile that is entirely invisible to the managed environment.

The distinction matters because BYOD governance focuses on the device: encryption, remote wipe, application management on the enrolled device. Shadow IT governance focuses on the behaviour: what accounts access company data, what extensions have permission to read or modify that data, and what AI tools are processing it.

These are separate problems. A well-configured BYOD policy does not automatically address the shadow IT behaviour that happens through it.

Personal devices are where the friction between official tools and personal preference is highest. Employees who find the company-approved browser, productivity tool, or communication app slower or less capable than their preferred alternative will often use the personal version in their personal profile on their personal device, even when accessing company resources.

Browser extensions are a particular accumulation point. An AI writing assistant, a tab manager, an email productivity tool: each can be installed in a personal Chrome or Edge profile in seconds, without any endpoint management tool seeing it, without any IT review, and with permissions that may include reading the current page, accessing the user's mailbox, or injecting content into the browser session.

When that browser session is also accessing company email, internal documents, or business SaaS tools, the extension's permissions apply to company data. The extension was never reviewed. IT is unaware it exists.

Data exfiltration via personal accounts. An employee who uses a personal Dropbox, Google Drive, or OneDrive account to transfer files between their personal device and work is creating a data pathway that bypasses your DLP controls, your backup policies, and your data classification. When that employee leaves, the data stays in their personal account.

Browser extension access to company data. Extensions installed in a personal profile can read and modify the content of pages the user is visiting, including company web apps. An extension that has been granted "read all page data" permission has access to whatever the user can see in the browser, including authenticated sessions in company SaaS tools.

AI tools in personal profiles. Personal AI accounts used to process work documents, summarize company emails, or assist with internal communication create data flows to external models without a DPA, without data classification, and without IT knowledge. Microsoft finds that 78% of people who use AI at work bring their own tools (Microsoft, 2024). Many of those tools run in personal profiles on personal devices.

Credential overlap. Employees who use the same password for personal and work accounts, or who store work credentials in a personal password manager, create a credential risk that does not appear in your identity posture until a personal account is compromised.