The presence of Shadow IT in educational settings often stems from users' attempts to fulfill work needs that are not met by formal systems. These tools, typically accessed outside institutional infrastructure, are preferred due to their practical use in day-to-day activities. However, such informal practices have been observed to trigger a variety of technical and security-related issues that remain undocumented by institutional IT policies. These tools may also pose significant risks to information security and work system reliability. This research aims to examine recurring problems encountered by users and interpret how these issues relate to key components in the work systems such as participants, technologies, information, processes, and products/services. The study employed a qualitative case study and applied the Eisenhardt method (1989) approach involving 35 respondents through interviews and field observations. Data was analyzed using open coding to extract recurring problem patterns. The analysis revealed four primary categories of problems System Error, Slow System Response, Access Limitations and Data Loss. These findings indicate that Shadow IT disrupts the flow of information and affects both technological and human elements within the work system. The study contributes by mapping factual user difficulties to concrete IT security needs that extend beyond formal policies. It suggests that effective IT security must address not only technical safeguards but also user behavior, access reliability, and adaptive policies capable of integrating informal digital practices.