What is shadow IT?

Definition

Shadow IT is technology — typically SaaS applications, but also devices, browser extensions, and cloud accounts — adopted and used for work outside the visibility or approval of the organization’s IT and security functions.

Background

Shadow IT is rarely malicious. A team signs up for a scheduling tool with a corporate card, a designer connects a plugin to shared storage, an engineer starts a trial that needs read access to the code repository. Each decision is reasonable in isolation and none of them route through a review, because self-service SaaS is designed to need no procurement. The result accumulates quietly: most organizations are using meaningfully more third-party services than any list they maintain would show.

Why it matters

Every framework that addresses third parties assumes you know who they are. An unknown vendor is not assessed, not covered by a data processing agreement, not included in an access review, and not offboarded when a project ends or an employee leaves — so its access can outlive both. It also breaks incident response: when a vendor discloses a breach, the first question is whether you use them, and shadow IT means the answer is a guess. Auditors treat an incomplete vendor inventory as a control failure rather than an administrative gap.

Step by step

1. Start from records you already have: expense and card statements, SSO and identity-provider logs, and the OAuth grants users have approved against your email and file storage.
2. Read what your own domain publishes — domain-verification records, mail senders, and the third-party origins your website loads — since adopting a service often leaves a public trace.
3. Reconcile the findings against your vendor register and record what is genuinely new.
4. Assess and tier what you found by the data it can reach, not by what it costs.
5. Give people a fast, obvious way to request a tool, because a slow approval path is what produces shadow IT in the first place.
6. Re-check on a cadence: this is a recurring reconciliation, not a one-time cleanup.

Examples

• A marketing team runs a survey tool holding customer email addresses that never appeared in any vendor review.
• A former contractor’s account still has access to a file-sharing service that was never in the offboarding checklist because nobody knew it existed.
• A breach notification arrives from a vendor and nobody can say for certain whether the company is affected.

Common mistakes

• Treating shadow IT as a discipline problem to be solved with a policy, rather than a visibility problem to be solved with discovery.
• Blocking tools without offering a sanctioned alternative, which moves usage further out of sight instead of reducing it.
• Discovering once, fixing the list, and never reconciling again.
• Assuming a free tier is low risk; the cost of a service says nothing about the data it can reach.

FAQ

Free tools and downloads

• Vendor discovery (free, no signup)