The specter of shadow IT continues to cast shade over enterprise technology operations, and chief information officers (CIOs) are in denial about the scale of the problem.

That is the key conclusion drawn from Symantec’s “1H 2017 Shadow Data Report,” which analyzed the main challenges organizations face when attempting to ensure that data held in cloud apps and services remains secure and compliant.

The survey, which evaluated more than 22,000 cloud apps and services, 465 million documents and over 2.3 billion emails, demonstrated how IT decision-makers must keep a watchful eye over the applications their employees use.

Understanding the Threat of Shadow IT

In a blog post, Symantec executive Deena Thomchick said that organizations use more cloud apps than most IT professionals would expect. The average business now uses 1,232 cloud apps, which is roughly one-third more than they did as of the second half of 2016.

Despite this number, the average CIO believes that his or her business uses between 30 and 40 cloud apps. These figures highlight how shadow IT poses a growing risk to the technology department’s ability to prevent data loss.

The survey also found that businesses “broadly shared” 20 percent of all files held in cloud-based file sharing apps and almost one-third (29 percent) of emails stored in on-demand email platforms. Symantec defined a “broadly shared” file as one that is distributed to the whole organization, an outside third party or publicly to any individual who holds a link to the file.

The Dangers of Sharing Sensitive Information

There is some good news, however. Thomchick reported that it was common in the past to find that 10 percent or more of these broadly shared files contained sensitive data. She suggested that security-conscious organizations are doing better today, since just 2 percent of shared files included confidential information.

While the reduction in the proportion of files containing sensitive data is encouraging, it is concerning that the data being shared includes details relating to compliance, such as personally identifiable information (PII), payment card data and protected health records. Of the 29 percent of broadly shared email assets stored in the cloud, 9 percent included compliance-related data. In total, according to SecurityWeek, Symantec found 207 million emails that it considered at risk.

Implementing Measures to Curtail Shadow IT

SecurityWeek noted that the survey results are based on companies using Symantec’s CloudSOC products. These businesses are therefore already striving to keep cloud data safe. Figures for firms not taking a proactive approach could be worse.

With the constant introduction of new productivity and communication tools, users are more inclined to collaborate outside of IT-sanctioned applications. IT organizations must evaluate existing solutions for their adherence to enterprise standards and either embrace them or replace them with viable alternatives.

When it comes to reducing the risk posed by shadow IT, Thomchick advised companies to implement a range of information security measures and implored executives to share threat intelligence across business platforms. She also pointed to the importance of other techniques, such as auditing, real-time detection, data loss protection and post-incident analysis.