Cybersecurity Malaysia: 5 Shadow IT Habits That Create Blind Spots 

Employees often turn to digital tools to get work done faster. They may sign up for a file sharing platform, use an AI tool to finish a task, or install an app without checking with the IT team. For any business serious about cybersecurity Malaysia standards, these everyday habits deserve a closer look. 

On their own, these actions can seem harmless. The trouble starts when the business has no visibility or control over the tools being used. 

This is known as shadow IT. It covers applications, devices, cloud services and other technology used without the knowledge or approval of the organisation’s IT team. The UK’s National Cyber Security Centre describes these as “unknown assets” in its guidance on managing shadow IT. 

Shadow IT matters because unapproved tools can expose company data, weaken access controls and leave gaps in security monitoring. 

Here are five common shadow IT habits that businesses should watch out for. 

1. Using Personal Cloud Storage for Work Files

Employees may use a personal Google Drive, Dropbox or other cloud storage account to share files or open documents outside the office. 

These tools are convenient, but personal accounts rarely have the same security controls as company-managed platforms. 

Potential risks include: 

• Sensitive files being shared with unauthorised people. 

• Company data staying in personal accounts after an employee leaves. 

• Limited visibility into who accesses or downloads files. 

• Difficulty managing access permissions and data retention. 

Businesses should provide approved file sharing platforms with proper access controls, along with clear guidelines on how to handle company information. 

2. Signing Up for Unapproved AI Tools

AI tools are now part of everyday work. Employees use them to summarise documents, draft emails, analyse information and generate reports. 

The risk comes when staff enter confidential business information into tools that the organisation has not reviewed or approved. 

Depending on the tool and its settings, the information submitted may be processed or stored in ways that do not meet the company’s requirements. 

To reduce this risk, businesses should set a clear AI usage policy, name the approved tools, and explain what information employees can safely share. 

3. Installing Unauthorised Software

Employees may download apps or browser extensions to boost productivity or fix a technical problem. 

However, unapproved software can introduce vulnerabilities, ask for excessive permissions or clash with existing security controls. 

The IT team may also miss important updates if it does not know the application has been installed. 

Businesses can tackle this by keeping an approved software list, limiting unnecessary installation rights and monitoring devices for unauthorised applications. 

4. Sharing Accounts to Access Business Tools

When employees need quick access to a platform, they may share login details instead of requesting their own accounts. 

This creates a serious blind spot, because the organisation may not be able to tell who carried out a particular action. 

Shared accounts also make it harder to remove access when employees change roles or leave the company. 

Businesses should use individual user accounts, multi-factor authentication and role-based access controls wherever possible. Access should also be reviewed regularly so employees only have the permissions they need. 

5. Connecting Unapproved Devices to the Company Network

Personal laptops, mobile phones and other equipment may connect to the company network without proper security checks. 

These devices may be missing updates, endpoint protection or the security settings the organisation requires. 

If a compromised device connects to internal systems, it can raise the risk of unauthorised access or malware spreading across the environment. 

Businesses should set clear device policies and use network access control to manage which devices connect to corporate systems. 

Why Shadow IT Creates Cybersecurity Blind Spots 

Shadow IT becomes a problem when a business cannot see or manage the technology being used across the organisation. 

Without enough visibility, IT and security teams may struggle to work out where company data is stored, which applications can access it, and whether those applications meet the organisation’s security requirements. 

This makes it harder to detect suspicious activity, manage vulnerabilities and respond to security incidents. Continuous monitoring, such as the work a SOC does when responding to a cyber crisis, depends on knowing what is actually running on your network. 

For organisations concerned about cybersecurity in Malaysia, tackling shadow IT should be part of a wider security strategy that includes access management, employee awareness, endpoint protection and ongoing monitoring. 

How ACEiT Helps Businesses Improve Cybersecurity Visibility 

ACEiT provides cybersecurity and IT services that help businesses strengthen their security controls and see more clearly across their technology environments. 

Depending on your needs, these services can cover network security, endpoint protection, security monitoring, threat intelligence and Security Operation Centre capabilities. An outside review can also help, which is one of the reasons businesses work with a cybersecurity consultant. 

Not sure what is happening across your company’s IT environment? Talk to ACEiT. 

The ACEiT team can assess your current security setup, find visibility gaps and explore practical ways to manage unauthorised applications, devices and access risks.