A shadow spreadsheet is the file where a critical metric actually gets produced, outside any system of record, maintained by one person, and unknown to most of the people who consume its output.
Nearly every security function has several. They are usually the most important measurement infrastructure the organization has, and they appear on no architecture diagram.
Because they work, immediately, and nothing else does.
A number is needed for a committee next week. Building an integration takes a quarter. Someone opens a spreadsheet, pulls three exports, writes the formula, and produces the number on Thursday.
That is the correct decision at the time. The problem is that the temporary arrangement becomes permanent, and then becomes load-bearing.
The formula lives in cells rather than in a definition, so nobody can review it and nobody knows when it changed.
The source extracts get overwritten, so the history cannot be recomputed. See reproducibility.
Copies proliferate. Within a year there are four versions and the one producing the reported number is not obviously identifiable.
Corrections overwrite prior values with no record of the change.
And the whole thing depends on one person. The risk is not that they are careless. It is that they leave, and what leaves with them is the only complete understanding of how a number the board sees is produced.
The spreadsheet is not the villain. The absence of an alternative that is equally fast is.
Any migration plan that requires the manual path to be abandoned before an automated one exists will fail, because the committee still meets next week.
Extract the definition first, before anything else. Write down what the formula actually does, including the exclusions that exist only as a filter someone applied by hand. This alone removes most of the key-person risk.
Move the data in, keeping the manual entry path. If people can record the same values with an owner, a date and attached evidence, the spreadsheet loses its speed advantage without losing its function. See manual data entry.
Automate individual sources afterward, one at a time, without changing the metric definitions built on them.
Do it in that order. Programmes that start with integrations tend to spend a year building pipelines while the spreadsheet keeps producing the numbers that actually get reported.
From the blog