Podcast: A Different Perspective on Shadow IT

Shadow IT usually is the crux of IT teams. It creates an issue of visibility within the IT stack that leaves IT in the dark. But maybe that's not the whole story?

Usually, when shadow IT happens though, it’s because IT is not allowing for fast workflows or certain operations are a hindrance to agility in the workplace. Therefore, employees will take matters into their own hands and implement solutions without the guidance or oversight of IT. It’s generally considered a huge problem, but there are always two sides to the story.

Think about it? What times could shadow IT be a good thing for IT teams and ultimately, the rest of the business? In a SaaS-driven corporate landscape, maybe IT departments should change their perspective on shadow IT? Of course, shadow IT usually is a symptom of some more significant issue at hand and not necessarily the problem in itself.

Uri Haramati, the CEO of Torii, joined the podcast to discuss this interesting perspective he has on Shadow IT. Torii is a SaaS-based solution that integrates all the data sources on a business network, which in turn allows for agile workflows to prosper, while also reducing costs and giving IT the visibility they need.

You can learn more about Torii here.

Transcript

Greg: So, to get started. So I was really interested to have you on today because, you know, usually when I talk to IT people they tell me, obviously, Shadow IT is a problem. It's not something they want to happen on their environment. And, as I said, it's usually a symptom of some other issue that, maybe, they need to resolve. But could you give us a better understanding of what Torii offers IT teams and give me an idea of how you got into IT yourself?

Uri: Sure. So, my background...I built a couple of companies in the past 10 years or so. And while scaling the companies, part of my role was in charge of operations. And part of it is, obviously, IT and SaaS and software. And in my last company, when we scaled, I left about three years ago to start something around SaaS management because I felt there is an increase in software and an increase in technology. And there was no way to manage that.

So, in general, if you look in modern enterprise today, they use hundreds of cloud-based solutions, right? And they must do so in order to stay relevant. But the problem is that how to centralize and manage the company software. And that's pretty much where Torii comes in. We make software manageable again. So it automatically discovers and maps all cloud application licensed to the users and using advanced workflows automation engine. And the company can reduce costs, reduce time spent on managing these tasks and technology and speed up productivity and in general processes. So that's actually in a nutshell what brought me into that and what Torii is offering.

Greg: As I was saying before, you know, when we first connected, you were talking about Shadow IT, and it's not necessarily a bad thing. Why do you think Shadow IT is okay in specific scenarios?

Uri: So, in general, Shadow IT is not good, right? And it causes a lot of tasks, a lot of pain for IT and the company in general. And there's a blog post I wrote about the good, the bad and the ugly around Shadow IT. Obviously, the bad and the ugly are more obvious, right? And Shadow IT is nothing new. It started...I think the early discussions around Shadow IT were when you got bring your own device and you had mobile apps installed that are outside of the company's environment. And then when SaaS started to grow up and companies started adopting SaaS environments and cloud-based applications, it became much easier for everyone in the company to just sign up new solutions and start using new software without anyone controlling that.

And there's another trend you can add to that, which is the change in demographics, right? When you have more and more younger demographic. And for now, I think today it's about 35% of the workforce in the U.S. that are millennials. These are people that were born into world software. Downloading apps, for them, it's a click of a button. So it makes more sense for them, "Hey, why don't I just sign up and start using these tools?"

And when you look at it, it is bad Shadow IT and there is very ugly parts in Shadow IT. But the motives and the reasoning behind Shadow IT are actually good in most cases, right? So there was a survey done by NDT that was researching why people are using Shadow IT. And 60% of it was to increase efficiency, right? So why someone is using a new tool that without asking anyone because here's the problem, you found the solution and you want to make his life better or be more productive or save time. And that's why they address these new solutions. And that's one reason that usually we tend to ignore around Shadow IT. Does that make sense?

Greg: Yeah, it does. But then you said obviously, Shadow IT can be okay in specific scenarios. I mean, I know me personally, I probably drive my IT team nuts because, like you said, I'm always downloading apps and obviously, they want to be able to test these things before they deploy them into the business environment. But obviously, it's not realistic to have that ability every time. I think just because people are trying to get so much done so quickly. Don't you agree?

Uri: Yeah. And then you look of what's actually good there. So first, it's an indicator, the reason motivation of individuals to achieve more, right? The reason motivation for someone to get a better job or their job done better, right, by using latest technologies or different technologies or new technologies, right? Another thing is that when you are looking in who are the largest contributors of Shadow IT to the environment, usually these are early adopters of technology.

And then, when IT recognizes these people, they actually can use them as an IT extension within the company. And they can be in every department, right? Every department, if it's finance or marketing or sales or product, you're going to have those early adopters that are starting to use new tools in order to make their life and work more productive. And once IT identify these people, they can actually work better with them as the IT extension, right? They will be more responsive for using new tools and be better testers within the company for the IT environment, and IT-sanctioned solutions. They also can be taught or have deeper learning and teaching about security and measurements, right?

Greg: It's an interesting perspective. I guess, I never really thought of it that way where obviously, this is, you know, it can be eye-opening to IT and that they can learn something new from this. I guess, obviously, this is how IT and development teams probably work hand in hand. Development teams are probably always implementing new solutions, release a product or what have you and that IT, kinda, just has to work with them. But what about the visibility aspect? If somebody, say, implements, like a new tool and it's working for them, how would IT go about understanding that somebody is using something without notifying them and then figuring out that, "Oh, maybe we should implement this tool on the business network or we should implement this tool for our employees."? Because usually when Shadow IT happens, IT doesn't know about it anyways. Or maybe is it through monitoring or is it just... How can IT be proactive about finding out these types of Shadow IT solutions are being implemented on their network, I guess, is what I wanted to ask?

Uri: Yeah. It's interesting you asked that. Because this is something that we realized within time when we start building Torii, right? So we started from the point of, "Hey, there's chaos and everyone is losing control. Let's start with exceptional mapping." So we did automatic mapping of what is being used, how much is being used, and how much you pay for that. And we had different technologies. So some of them are browser extension that maps signing and logins for different SaaS solutions. Some of them might be third-party application that you connected to your G Suite account. And by connecting G Suite Torii, we can show you from the G Suite API, every tool that someone connected.

There are other sources of information that Torii, for example, uses for Shadow IT, for example, Slack, right? Slack became a hub for software. And we see companies that are connecting more than 100 tools just to Slack. So by connecting Slack to Torii, we can show the number or all the software that was connected and who connected it, which means that this person is using this third-party software. And after we did that, so we realized that now we see all this information. I can tell you the numbers are staggering, right? We see companies that go beyond 1,000 applications that are being used. 

So, we pretty much send a notification to the company A and you help us discover that this is the app. This is what it does. And that's the domain. And then we started on understanding what's like following the footprints of what do you do update, you've discovered this new tool. Because, as you said before, that it was shadowed and nobody knew about it. And there was no policies or workflows around it. So we realized that every time the company or IT...they pretty much when they realize or they get notified that a new tool was discovered and this person started using that, they're just approaching this person and asking if you got questions.

So we pretty much automate these parts. So every time a new app is being used, a form will be sent to the first person who used it asking them several questions. And these questions are the most basic questions, for the IT wants to know if they need further research or better understanding. For example, some basic questions are: Are you going to upload any PII to this tool? Are you going to integrate it with any one of our systems? Are you going to pay for it? So these three questions, the answers for these questions, can give the IT immediate actions of do they need to follow up? Do they need to stop it at once? Do they need to get better research? And then we see customers taking it to every different directions, like, I don't know. What is your evaluation? How much? What tool is it replacing? Because one of the bad part around Shadow IT, if you say the ugly part is security and data flow, that you have no idea where it goes, the ugly part is that some tools that the company is paying for or using are just not being used because someone positioned into his Shadow IT that nobody knows.

Greg: Interesting. I was actually just going to ask you about that because, for instance Slack, you were talking about, what if you're using JIRA or Microsoft Teams and your company prefer, you know, you've paid for all this money for this tool and then you find out somebody who is using Slack as opposed to what you have implemented. There's a, kind of, back and forth there between either the employees and IT as to what's the better tool.

Uri: Correct. And then what happens is that, let's say when it's not managed, IT will understand that Slack has been used after 200 people are using Slack and the new guy comes and they ask for a new license and the IT doesn't know that there's Slack in company, right? And then, all right, we need to do something about it. But now, when someone started using Slack, so the IT knows immediately that they are using that. So they might decide, "All right, we give you the freedom to test it for this month with your team. And then tell us, "What is up, why is it different from Microsoft Teams, what way is it better?" And then you can make a decision. Do we want to consolidate? Do you want to transition or we just want to shut down one of them? And so it's, kind of, outsourcing part of the IT evaluation process, right?

Greg: Yeah. It seems like it probably saves IT a lot of time testing stuff too because it's like, obviously, the employees are already using it.

Uri: Yeah. And there are also additional cases, like if someone used the software and then it stopped software as a Shadow IT, but the, IT knew about it from something like Torii and then they stopped using that. And let's say six months later the IT is considering using this tool, they can just reach out to this person and say, "Hey, you used it back then, you evaluated it, well, what do you think about it? What happened with it? How is it different, or what made the decision?" It can be also, kind of, postmodern for just random teams started using something and stopping using that before it's being managed by the IT, but within the knowledge of the IT. And you get all the information and transparency around everyone.

But because, in the end of the day, everyone is becoming techie, right? We are all much more techie than before and everyone knows more about technology and software is becoming much easier to manage and control on a personal basis, right? It's much easier for us in the past to understand how to use new tools. And then, what it means is that we can easily use these tools and get all the information around it. So if we do promote using latest technologies or the best technologies, if we promote the same time and transparency around using these tools and accountability around using these tools, there's no reason to move faster and work better within this multiple or proliferation of SaaS.

Greg: Yeah. And how is a SaaS solution like Torii able to help mitigate the dangers of shadow IT as we've been speaking about? And could you give us a specific situation that SaaS or, say, smart automation could allow Shadow IT to be able to prosper while giving IT the tools to mitigate the risk associated with it?

Uri: Yeah, so one of them is the work that I mentioned before, right? So every time a new app is being discovered, the IT can just set up a workflow, "All right, send us a notification or an email that the new was being used." At the same time, send this form to that person and notify someone from security, right? And when the person submit the form, send this form to X,Y,Z. So that's one part. The other part is learning and understanding about trends, right? So in Torii, you can see seminar tools that are being used for the same purpose pretty easily, right? That's part of our database and our engine understands, you know, that Box and Dropbox are being used for similar purposes.

So then if the company is officially using Box and then you can see the trend of Dropbox growing in within some kind of departments or remote site, it's something that is very easy to manage and understand for Torii and either mitigate or optimize or whatever.

Same goes for licenses, right? So if someone stopped using something, you can set up a workflow that this person stopped using the tool and then you can set up either to remove their license or send a request to remove the license or ask the person, "Hey, I saw you stopped using this tool. Can we take your licenses?" So it's a little bit less about around Shadow IT, but it's all part of, you know, both the transparency and having the visibility around your stack and creating this accountability within the entire company around the technology.

Greg: So it isn't so much that you're okay with Shadow IT. It's preferably, implementing the right tools, automation, and processes in place to actually help allow employees to stay agile. And it actually helps the process for IT for implementing new solutions, which is very interesting.

Uri: Yeah, totally. It's about getting Shadow IT of the lights and understanding the motives behind it, right, and understanding why people are using Shadow IT. Maybe it's something that we need to take care, in our company, to make some processes or policies lighter or weaker. And that's the good part of Shadow IT, right? It's an indicator if you have people using legacy technology and old tools and very minimal number of tools and not trying to innovate or update their current day to day with better technology and better software, then it means that they're missing something and...

Greg: Probably falling behind too.

Uri: Yeah, falling behind, and it's becoming a competitive advantage using these technologies. Sometimes people are taking it too far, right? And there's much trending software or something, you know, sexy tool that it's pretty much doing the same as your current tool. But sometimes these tools are really...they take the company forward with certain prospects and certain processes, right?

Greg: Yeah. So we're just around the 20-minute mark. But yeah, I want to thank you, Uri, for joining us today. I really appreciate the new insight on your prospect of Shadow IT and how Torii's helping with that.

Uri: Yeah, thank you very much. It was great to be here and it was fun to talk about the IT stuff.