A marketing department uses corporate cards to sign up for an unapproved file-sharing SaaS service and stores customer contact lists there. IT and security are unaware of the service until an employee mentions it. Which vulnerability does this represent?
Select an answer to reveal the explanation.
Short Explanation
Here's the thing -- the marketing team wasn't being malicious, they just wanted to get work done faster. But now customer data lives somewhere you can't see, can't control and can't audit. That's shadow IT, and you can't protect what you don't know exists.
Full Explanation
Shadow IT refers to hardware, software or cloud services that employees adopt without the knowledge or approval of IT and security. It typically arises from a legitimate business need and convenient purchasing, such as signing up with a corporate card. The vulnerability is that data processed in those services sits outside the organization's security controls: no vetting of the provider, no single sign-on or MFA enforcement, no data loss prevention, no logging and no assurance about retention or legal obligations for customer data. A rogue device is unauthorized hardware connected to the network, whereas the issue here is an external cloud service used through a browser. A supply chain compromise of an approved SaaS vendor would involve a vetted provider being breached, but this service was never approved and nothing indicates it was breached. An unpatched marketing file server would be a known internal asset missing updates, which is unrelated to data being moved into an unknown external service. Exam caveat: the best responses combine detection, such as monitoring cloud usage, with an approved alternative that meets the business need. Operational check: identify the data stored in the service, assess the provider, migrate the data to an approved platform or formally approve the service with controls, and review expense reports for other unapproved subscriptions.