A hálózat csapdájában

A kiberbiztonságról, mikro- és kisvállalkozásoknak

The invisible risk: what is Shadow IT and why shouldn’t I just plug that USB stick in just like that?

If you think that cyber security is “something for the big players” and doesn’t really affect your company — that’s a perfectly understandable feeling. You don’t have a dedicated IT department, you don’t have time to pore over security policies, and you’re probably juggling three things at once right now. This post isn’t written to scare you, but to highlight a very common, yet almost invisible risk — and to show that managing it is much simpler and cheaper than you might think.

It’s called: Shadow IT.

What is Shadow IT — explained simply

Shadow IT refers to the software, applications and devices that your colleagues use in their work, but which you (the company manager) are unaware of, or which you did not select or approve.

There’s no malice involved here. It’s almost certain that something similar happens in your organisation too:

  • A colleague stores the client list on their own Google Drive because “it’s easier that way”.
  • Someone sends company documents via WhatsApp because it’s quicker than email.
  • The accountant uses a free online spreadsheet programme to organise invoice data.
  • An employee uploads marketing materials to their own, private Dropbox account so they can access them from home.

None of these scenarios sounds particularly alarming. That is precisely the crux of the problem: a situation arises from entirely innocent, practical decisions made in the heat of the moment, in which you, the owner, have no idea where your company’s data is or how it is being stored.

“But we’re only a small business…”

This is one of the most common — and, unfortunately, mistaken — assumptions. There are two reasons why you should reconsider this.

Firstly: small businesses are specifically targeted. According to analyses reviewing the domestic cyber security landscape, attackers typically distinguish their targets by company size: they prefer to attack businesses with just a few employees and those with around 50 staff using phishing and ransomware, precisely because these typically have fewer resources for defence, making them easier targets than large corporations. This is not meant to be a scare tactic, but a statistical reality — and that is precisely why I also have some good news below on what you can do about it with a disproportionately small investment.

Secondly: the regulator is watching – even the small ones. For a long time, it was widely believed that the National Authority for Data Protection and Freedom of Information (NAIH) only penalised large companies.

In 2026, however, two cases came to light in which the NAIH specifically sanctioned small businesses — in one instance, a fine was imposed because a website’s data processing notice was incomplete. For minor infringements, fines typically range from several hundred thousand to between 500,000 and 1 million forints; in more serious or repeat cases, however, they can reach as high as ten million forints.

The four main risks posed by Shadow IT

1. You lose control over your data

If an employee stores customer data in their own account and resigns, your company’s data goes with them — or simply becomes inaccessible. If such an account is hacked, you may never even find out, as it is not part of your system. This is one of the most fundamental problems: you cannot protect something you do not even know exists.

2. Legal and financial risks (GDPR)

If you process customer data, email addresses or billing details — and almost every business does — the GDPR applies to you, regardless of your company’s size. If data stored in an unauthorised application is leaked, your company remains liable even if you were personally unaware of the existence of the device in question. Failure to report a data breach to the regulator within the 72-hour period prescribed by law constitutes an aggravating circumstance — this in itself may result in a fine, regardless of the actual severity of the damage. This point is particularly important in the case of shadow IT: if you are unaware of a data breach, you cannot report it in time.

3. Ransomware and phishing

Unauthorised, often free tools typically have weaker security protection than officially deployed, business-grade solutions. This attack surface increases with every application you are unaware of. According to a 2025 international survey (Sophos State of Ransomware), nearly half of the companies that suffered a ransomware attack paid a ransom to recover their data — the second-highest proportion in the past six years. Furthermore, according to domestic analyses, a significant proportion of Hungarian businesses are still not prepared to meet even basic cybersecurity requirements.

4. Business continuity risk

What happens if the colleague who ‘just’ set up a system using their own account resigns tomorrow? If they were the only one with access to the customer database via an unofficial application, the company could lose access to its own data overnight. This is not a theoretical risk — it is one of the most common and most troublesome consequences of shadow IT.

The good news is that this doesn’t mean you have to become an IT expert

Cybersecurity is no longer the exclusive preserve of large corporations — there are an increasing number of cloud-based solutions that can be rolled out gradually and tailored to the size of your business, improving protection at a reasonable cost. With a few simple, inexpensive (and in many cases free) steps, the majority of risks can be managed:

  • Ask your team what tools they actually use. Not with the intention of punishing them, but out of curiosity: “What applications do you use on a day-to-day basis?” This single question often reveals more about shadow IT than any technical audit.
  • Choose an official channel for file sharing and communication, and ask everyone to use it. You don’t need to choose the most expensive option — the key is to have everything in one place that you can keep track of.
  • Introduce a password manager and two-factor authentication for your most important accounts. This is one of the cheapest and most effective security measures a small business can take.
  • Draw up a short, one-page internal policy setting out which devices may and may not be used for company data. You don’t need to write in legal jargon — the main thing is that it’s clear.
  • Make the most of free local support. As a joint project between the Hungarian Chamber of Commerce and Industry (MKIK) and the Supervisory Authority for Regulated Activities (SZTFH), a free, automated vulnerability scanning service (SecureBot) has been launched specifically for small businesses; it alerts you if your company may be vulnerable to certain external digital attacks.

When is more stringent compliance required?

Since the 1st of January, 2025, a new cybersecurity law (Act LXIX of 2024) has been in force in Hungary, transposing the EU’s NIS2 Directive into national law. This primarily affects organisations operating in critical and important sectors, typically larger organisations — but in certain areas of activity (such as digital infrastructure services), it may also apply to micro- and small enterprises, regardless of their size. As the precise scope of this regulation may vary from company to company, and the details are constantly evolving, if you are unsure whether it applies to you, it is worth seeking information directly from the MKIK or the SZTFH — a blog post cannot replace this.

Concluding remarks

Shadow IT isn’t dangerous because your colleagues are careless or because your business is particularly vulnerable. It’s dangerous because it essentially consists of human, common-sense decisions — and that’s precisely why it’s so easy to overlook. The good news is that even a single honest conversation with your team, a shared file-sharing platform and the introduction of a password manager are huge steps towards safer operations. You don’t have to sort everything out at once — you just need to get started.

Sources used

Vélemény, hozzászólás?