A systems administrator notices that the research and development department is not using the company VPN when accessing various company-related services and systems. Which of the following scenarios describes this activity?

Shadow IT refers to IT systems, devices, software, and services used within an organization without explicit organizational approval or oversight. In this scenario, the R&D department is using services and systems without going through the company VPN, which is an unapproved method of access, thus falling under Shadow IT. This practice often bypasses security controls and can introduce significant risks. Espionage involves stealing secret information, which isn't directly described here. Data exfiltration is the unauthorized transfer of data out of a system, which might be a consequence of Shadow IT but isn't the activity itself. A nation-state attack is a cyberattack sponsored by a government, which is not indicated by the department's behavior.