I cannot understate the danger of shadow IT.  It bypasses security processes, testing procedures, tools, patching mechanisms and almost everything else in place to properly defend an organization.  This article is a cringe worthy example.

https://nakedsecurity.sophos.com/2018/05/22/server-what-server-site-forgotten-for-12-years-attracts-hacks-fines/