The Warning Most Businesses Missed
In March 2026, the NCSC warned NZ organisations to be alert to staff using work credentials — specifically work email addresses and passwords — for personal services, shadow IT tools, or consumer applications. The warning was issued in the context of evolving threat activity, but the underlying risk is not new.
This is one of the most common and most underestimated security vulnerabilities in NZ businesses. It is not primarily a technology problem. It is a behaviour problem — and behaviour problems require training, not just policy.
What Shadow IT Actually Looks Like
Shadow IT is any technology, application, or service used by employees without IT or management approval. In 2026, it is pervasive in almost every NZ workplace. Common examples:
- Using a personal Dropbox or Google Drive to share work files because the approved system is slow or inconvenient
- Signing up for a free AI tool or productivity app using a work email address
- Using a personal project management tool for a team that found the approved one too complex
- Connecting a personal device to the work network to access systems more conveniently
- Using WhatsApp or personal messaging apps to share work information
None of these feel dangerous to the employee doing them. Each of them creates a real risk exposure for the business.
The Credential Reuse Problem
The specific risk the NCSC highlighted is this: when employees sign up for personal services or unapproved apps using their work email address, they often use the same password they use at work — or a closely related variant.
Here is why this becomes a serious problem:
- Consumer services are breached frequently. Password databases from breached services are sold on dark web markets within days of the breach.
- Attackers use credential stuffing — automated tools that try breached username/password combinations against thousands of other services, including corporate email systems and business applications.
- If an employee used their work email and a variant of their work password to sign up for a breached consumer service, attackers now have a starting point for attacking the business.
CERT NZ documented multiple NZ business compromises in 2025 that started with credentials exposed in third-party consumer service breaches. The business had no connection to the breached service — but an employee did.
Why Policies Alone Do Not Work
Most businesses address this with a policy. "Do not use company email addresses for personal services." "Do not reuse passwords." The policies are correct. They do not work on their own.
Research consistently shows that employees who understand why a security policy exists comply more reliably than those who simply know the rule. An employee who understands that their personal Netflix password reuse could give an attacker access to the company's financial system behaves differently than one who has signed a policy they do not remember.
Security awareness training that addresses credential hygiene — in practical, specific terms — is one of the most cost-effective controls for this risk. See our guide on phishing training for employees for how to structure awareness training that actually changes behaviour.
The Shadow IT Inventory Problem
Before you can manage shadow IT risk, you need to know what shadow IT exists in your organisation. Most businesses are surprised by the results when they look properly.
Practical steps:
1. DNS and proxy log analysis: If you have a web proxy or DNS filtering in place, review what external services are being accessed from your network. Tools and services your IT team does not recognise are candidates for shadow IT.
2. Employee survey: Ask employees directly — anonymously if necessary — what tools they use to get their work done that are not officially approved. The responses are usually illuminating.
3. SaaS discovery tools: Commercial SaaS discovery tools can identify cloud services connected to your corporate identity (typically via OAuth or SSO). Many businesses discover dozens of unapproved integrations this way.
4. Review OAuth approvals: In Microsoft 365 and Google Workspace, employees can grant third-party apps access to their email, calendar, and files. Regular review of approved app permissions often reveals services the business did not know were connected.
What to Do With What You Find
Shadow IT exists because approved tools are not meeting needs. The right response is not purely enforcement — it is a combination of addressing the legitimate need and removing the risky workaround.
For each shadow IT tool you identify:
- Assess the data it has access to and the risk it creates
- Determine whether the underlying need can be met by an approved tool
- If the tool is low-risk and meeting a genuine need, consider approving it formally — with appropriate controls
- If the tool is high-risk (has access to sensitive data, uses weak authentication, is run by an unknown provider), remove access and provide an alternative
For credential reuse specifically, the short-term fix is mandatory password reset for any accounts where employees may have reused credentials, combined with enforced MFA on all business systems.
The Password Manager Question
The most effective technical control for credential reuse is a business password manager. When employees use a password manager to generate unique, complex passwords for every service, credential reuse becomes structurally impossible — regardless of whether they use their work email to sign up.
Business password managers (Bitwarden Teams, 1Password Business, Dashlane Business) also give IT administrators visibility into what services employees have credentials for, which is a partial shadow IT discovery mechanism.
The NCSC recommendation — and CERT NZ guidance — is consistent: use a password manager, use unique passwords everywhere, and enable MFA on every account that supports it.
SecureAZ provides security awareness training that covers credential hygiene, shadow IT risks, and phishing — delivered in modules your team can complete in under 20 minutes, with tracked completion for compliance purposes.