Shadow IT in Education: The Hangover from Emergency Remote Learning
The tools adopted in days during 2020 are still running in the background. Most have never been audited, inventoried, or properly offboarded.
Executive Summary
The emergency SaaS sprawl that kept education running in 2020 never fully receded, and the resulting shadow IT estate is now the most consistent source of breach and compliance risk for schools. This article walks through the cleanup pattern that actually works without breaking instruction.
Shadow IT is not a new problem. It is the oldest tension in enterprise technology: users need tools, central IT moves slowly, and someone finds a workaround. In education, this dynamic is amplified by academic freedom, decentralized purchasing, and a culture that treats technology adoption as personal choice rather than institutional risk. The pandemic did not invent shadow IT in schools and universities. It exploded it.
What Happened in 2020
When buildings closed, the procurement and vetting processes that normally took months were compressed to days. Teachers needed video conferencing immediately. Administrators needed document collaboration. Counselors needed secure ways to reach students. IT departments, already understaffed, made rational decisions to approve tools quickly rather than block instruction.
The result was a proliferation of cloud applications, browser extensions, personal device syncing services, and messaging platforms that no one had formally reviewed. A teacher signed up for a free tier of a video platform. A department started sharing files through a consumer cloud drive. A principal purchased a messaging app with a credit card to coordinate bus schedules. Each decision was locally logical. In aggregate, they created an invisible, unaudited technology layer.
Why It Persisted
The emergency ended. The tools did not. By 2022, most institutions had returned to in-person operations, but the shadow IT layer remained for several reasons.
User attachment. Teachers and staff had invested time learning new tools. They had built lesson plans, file structures, and communication habits around them. When central IT proposed sunsetting an unauthorized platform, the response was often organized resistance.
Vendor lock-in. Free tiers converted to paid subscriptions. Data accumulated in proprietary formats. Exporting work to an approved platform became technically difficult or functionally lossy. The cost of switching, measured in staff hours and data migration, exceeded the perceived risk of keeping the tool.
Institutional amnesia. The staff who approved emergency tools left. The documentation, if it existed, was lost. New administrators inherited a technology environment that included systems they did not know existed and could not identify in a standard asset inventory.
The Risk Profile Today
Shadow IT in education creates risk in ways that are distinct from corporate environments.
Student data exposure. An unaudited math platform may store student names, performance data, and behavioral analytics under terms of service that the district never reviewed. If the vendor is breached, the institution is liable for notification, credit monitoring, and regulatory penalties, even though it did not formally authorize the relationship.
Authentication bypass. Shadow applications often use standalone credentials. A compromised password on an unmonitored platform may be identical to a password on the institution's primary identity provider. Attackers routinely credential-stuff across education platforms because they know shadow IT creates credential reuse with weaker monitoring.
Compliance gaps. FERPA, COPPA, and state student privacy laws apply to all data collection, not just the systems on the approved list. An unauthorized survey tool that captures student responses is a FERPA violation waiting to be discovered, regardless of whether the teacher who deployed it understood the regulation.
Supply chain opacity. Institutions cannot patch, monitor, or incident-response what they do not know exists. When a major vulnerability is disclosed in a video conferencing platform, the security team needs an accurate inventory to know whether the institution is exposed. Shadow IT makes that inventory impossible.
A Practical Cleanup Process
Eliminating shadow IT is unrealistic. Managing it is not. The institutions that have made progress follow a consistent pattern.
Discovery. Use network monitoring, DNS logs, and single sign-on analytics to identify every cloud application that institutional accounts touch. Publish the inventory to department heads and ask them to confirm what their staff uses. The gap between technical discovery and self-reported usage is where the real risk lives.
Triage. Classify every discovered tool by data sensitivity, number of users, and regulatory exposure. A consumer messaging app used by three teachers for lunch planning is lower priority than an unapproved gradebook syncing with a learning management system.
Rationalization. For each high-priority tool, make a deliberate decision: formally approve and integrate it, migrate users to an approved equivalent, or sunset it with a clear data extraction plan. Avoid the trap of allowing unauthorized tools to persist indefinitely because no one wants to make a decision.
Prevention. Build a lightweight app request workflow that returns decisions in days, not months. When central IT is the fastest path to a legitimate tool, users have less incentive to go around it. Publish a clear catalog of approved tools by use case and update it regularly.
Accountability. Make department heads responsible for the technology their staff uses. Include shadow IT discovery in internal audit scopes. Tie compliance to budget decisions, not just policy documents.
The pandemic emergency created a reasonable exception to normal controls. Continuing to operate under emergency exceptions years later is not reasonable. The institutions that acknowledge this and clean up deliberately will be the ones that survive the next incident without a breach notification letter.
Sources and Citations
- CoSN, Driving K-12 Innovation reports, 2022 and 2023.
- Common Sense Privacy Program, State of EdTech Privacy reports, 2022 and 2023.
- EDUCAUSE Information Security Almanac, 2022 and 2023.
- Student Privacy Compass research briefs on app sprawl and FERPA risk.
- K12 Security Information Exchange, vendor incident reporting summaries, 2022 and 2023.