Ask an OT security lead at any utility why their SCADA network sits behind an air gap, and the answer is almost always the same: because it has to. Substations, generation assets, and the RTUs and PLCs running them are critical infrastructure, and critical infrastructure gets isolated on purpose.

Shadow IT risks are quietly reshaping the job of every IT administrator, whether they have noticed it yet or not. Shadow IT itself is nothing new: it is any hardware, software, or cloud-based services running on company systems without the knowledge or approval of the IT department. What has changed is the scale of it.

The NIS2 directive is no longer a project on the horizon. It is enforced EU law, and national law in most member states now reflects its requirements for cybersecurity risk management, incident reporting, and business continuity. Compared with its predecessor, NIS1, the scope has grown substantially: many more organizations across critical sectors and important entities now fall under the regulation, from energy and transport to healthcare, banking, and digital infrastructure.