Every Department Has One: The Unpaid IT Department Hiding in Plain Sight

Ask any IT director at a mid-sized American company to name their biggest security risk, and you'll hear the usual suspects: phishing, unpatched VPNs, third-party vendors. Rarely will they mention the payroll specialist in the Columbus office who has admin rights to the scheduling software because she set it up in 2019 and nobody ever took them away.

She is not alone. Every organization of meaningful size has at least one of her — the departmental power user who becomes the de facto help desk for an entire floor. Call it what you want: the shadow admin, the go-to person, the person who "just knows computers." From a governance standpoint, what matters is that this individual is performing IT functions outside every control structure the organization has built.

How the Shadow Admin Comes to Be

The origin story is almost always the same. A ticket queue backs up. Remote support is slow. A colleague is desperate to submit an expense report before a deadline. Someone nearby fixes the problem in ninety seconds, gratitude flows, and a pattern is established.

Over months, the informal role calcifies. The shadow admin accumulates credentials, workarounds, and tribal knowledge. They build spreadsheet macros that become load-bearing infrastructure. They know which SaaS license is shared across four people and which printer driver requires a specific reboot sequence. None of this appears in a configuration management database.

The behavior is rational on all sides. End users get faster resolution. The shadow admin gains status and, often, genuine enjoyment of the work. IT sheds ticket volume it couldn't handle anyway. The problem is that everyone involved is optimizing for convenience while quietly dismantling accountability.

The Liability Nobody Priced In

The security exposure here is not theoretical. A shadow admin with a shared login to a benefits platform is an unmonitored identity with privileged access. If that person leaves the company, the credentials often leave with them — or worse, stay behind, still active, known to whoever replaced them informally.

Unapproved workarounds compound the risk. That macro exporting HR data to a personal Dropbox account was created with good intentions, but it is a data exfiltration path that no DLP solution was configured to catch. The homegrown database holding customer records on a departmental workstation has no backups, no encryption at rest, and no owner on paper.

There is also a compliance dimension. Organizations subject to SOX, HIPAA, or state privacy laws such as the California Consumer Privacy Act need to demonstrate who accessed what, when. Shadow admin activity is, by definition, invisible to audit. When a regulator asks how access to a system is controlled, "Karen in accounts payable handles it" is not an acceptable answer.

The Case for Formalization

Here is the contrarian argument, and the one this publication finds more compelling: the shadow admin is not merely a problem to be eliminated. This person has demonstrated aptitude, initiative, and institutional knowledge — three qualities the IT talent market makes painfully expensive to acquire.

The IT job market remains structurally tight, particularly for support and operations roles that blend technical skill with business context. Meanwhile, the organization already employs someone who fixes problems, documents workarounds nobody asked them to document, and has earned the trust of end users. That is a candidate, not a threat.

Formalization can take several forms:

• A designated power user program, with defined permissions, training, and a direct line to the help desk — a middle tier between end users and full IT support.
• A formal role change, moving the individual into desktop support or systems administration, often with a certification pathway to close skill gaps.
• A documented handoff, where the shadow admin's workarounds are inventoried, rebuilt properly, and their informal credentials retired.

The first option suits large enterprises. The second suits mid-market firms where a career pivot is feasible. The third is the minimum viable response for any organization unwilling or unable to do more — and it is still vastly better than ignorance.

Defusing the Role When Formalization Isn't Possible

Some shadow admins do not want the job. They like accounting; the IT work is a favor, not an ambition. Forcing a role change on a reluctant employee helps no one. In these cases, the goal is containment: discover what they have access to, migrate their informal fixes onto supported tooling, and remove the credentials that no longer need to exist.

Discovery is the hard part. Access reviews, SaaS license audits, and network scans surface most of it, but the human conversation matters more. Ask department heads a direct question: who do people call when IT is slow? The answer will be uncomfortable and useful in equal measure.

An Honest Accounting

The shadow admin exists because the formal system failed first. Slow support, rigid tooling, and understaffed help desks created the vacuum, and someone filled it. Security leaders are right to see risk in that arrangement. Talent leaders should see opportunity in the same person.

Organizations that treat shadow admins purely as a threat will spend their energy on lockouts and policy memos, and the workarounds will simply move somewhere less visible. Organizations that recognize an accidental recruitment pipeline — and build a legitimate path for these people — convert a liability into one of the cheapest hires they will ever make. The choice, unlike the shadow admin's credentials, should be deliberate.