Shadow IT could be seen as ignoring externalities such as security, operational resilience, and process coherence in order to "get things done". Eventually the bill comes due (security incident, key employee exit, incorrect results). Questions are: can you recognize failure? who pays to fix it? what happens while it's being fixed?