Shadow IT risks are quietly reshaping the job of every IT administrator, whether they have noticed it yet or not. Shadow IT itself is nothing new: it is any hardware, software, or cloud-based services running on company systems without the knowledge or approval of the IT department. What has changed is the scale of it.

The NIS2 directive is no longer a project on the horizon. It is enforced EU law, and national law in most member states now reflects its requirements for cybersecurity risk management, incident reporting, and business continuity. Compared with its predecessor, NIS1, the scope has grown substantially: many more organizations across critical sectors and important entities now fall under the regulation, from energy and transport to healthcare, banking, and digital infrastructure.