Shadow automation is unofficial or weakly governed automation that runs outside normal IT or security oversight. It may be a script, bot, spreadsheet macro, workflow tool, or AI-assisted process created to save time, but without clear ownership, documentation, testing, or change control. Because it is not fully visible to security and compliance teams, it can behave like hidden infrastructure.
In cyber security, shadow automation matters because it expands the attack surface and weakens accountability. A forgotten script may keep using privileged credentials, move sensitive data, or make unreviewed changes after requirements shift. Attackers can abuse the same blind spots by planting automation, hijacking scheduled jobs, or exploiting poorly monitored service accounts. Defenders look for inventory, approval workflows, logging, least privilege, and reproducible change records so every automated action can be traced back to a person, purpose, and version.