Shadow IT isn't a rebellion. It's a vote of no confidence in procurement.
Thirty-eight percent of technology purchases are now managed by business leaders, not IT. Calling that a discipline problem misses what the number is actually measuring — trust in how fast IT can say yes.
Thirty-eight percent of technology purchases are now managed, defined, and controlled by business leaders rather than IT, according to Gartner. That figure is usually framed as a governance failure. It is more accurately read as a customer-satisfaction score, and IT is the vendor being rated.
Business units are not evading policy for fun
Teams cite IT's own procurement process as the reason they route around it — not because the policy is wrong in principle, but because it is too slow relative to the AI tooling market's pace. Nearly two-thirds of companies report employees using AI without oversight, and 77% of technology leaders say AI adoption is already outpacing their governance capacity. When a business unit can adopt a tool in an afternoon through a credit card and a browser tab, and the sanctioned path takes a quarter, the business unit's choice is not defiance. It is a rational response to a process built for a slower market.
The cost is duplication, not just risk
The immediate risk of shadow IT — ungoverned data, unmanaged access — gets most of the attention, and it is real. But the quieter cost is duplication: departments independently buying tools that an enterprise license already covers, because nobody could tell them it existed. That produces underused seats, redundant renewals, and a rising bill for capability the company already owns twice over. Shadow IT is not only a security exposure. It is also a procurement failure showing up as wasted spend, which is a more persuasive argument to a CFO than a hypothetical breach.
Fixing the incentive, not the enforcement
The CIOs having success here are not the ones tightening the gate. They are the ones making the sanctioned path faster than the workaround — collapsing procurement timelines for a defined class of low-risk tools, and treating the CIO's job as earning the business's confidence rather than policing its patience. That reframes the fix: less "how do we catch shadow IT" and more "why did the business stop trusting us to move at its speed."
If 38% of purchases are happening outside IT, the number to chase down first is not how many violations occurred. It is how long your official process takes relative to the alternative every business unit already has in a browser tab.