topics
what each risk is, in plain words.
54 short explainers on shadow IT, the apps, the AI and identity. Each starts with a one-line definition, carries the numbers worth knowing and points to the guide that goes deeper.
shadow IT.
The tools people adopt on their own, why it happens, what it costs and how to find it without a ban.
- BYOD and shadow ITBYOD governs the device; shadow IT on personal devices lives in browsers, personal accounts, and AI tools IT cannot see.
- cost of shadow ITShadow IT costs show up in three places: security exposure, compliance liability, and direct redundant software spend.
- how shadow IT happensShadow IT forms through decentralized buying, offboarding gaps, integration sprawl, and fast AI adoption.
- personal accounts for workWork done through personal Gmail, Drive, or ChatGPT accounts leaves no trace in your directory and no access for you to revoke.
- shadow cloudShadow cloud is infrastructure spun up outside the company tenant: dev accounts, trial projects, and databases nobody registered.
- shadow IT and complianceGDPR, NIS2, and DORA all require knowing what processes your data; shadow IT creates tools and access outside that record.
- shadow IT discoveryShadow IT discovery is the structured process of finding every unmanaged app, account, and integration in your environment.
- shadow IT examplesShadow IT in practice means former-employee accounts, forgotten OAuth grants, free trials that stayed, and personal AI tools.
- shadow IT policyA shadow IT policy defines how new tools enter your environment; it works only when it is faster than going around it.
- shadow IT risksShadow IT creates credential, OAuth, data, compliance, operational, and supply chain risk, all rooted in missing visibility.
- shadow IT vs sanctioned ITSanctioned IT is what IT manages and reviews; shadow IT is everything else. Most tools sit on a spectrum between the two.
- what is shadow ITShadow IT is every app, device, integration, and AI tool a company uses outside formal IT management.
the apps.
Trials, integrations, OAuth grants, spend and the vendors nobody switched off.
- abandoned SaaS trialsAn abandoned trial is an evaluation account that was never adopted and never closed, still holding data and valid credentials.
- apps outside SSOApps outside SSO authenticate on their own credentials, so offboarding, MFA, and access reviews from your IdP never reach them.
- browser extensionsBrowser extensions can read page content, form input, and open tabs, and most organizations keep no inventory of what is installed.
- duplicate SaaS toolsDuplicate tools are apps doing the same job for different teams, bought independently because nobody could see the overlap.
- no-code automation sprawlEvery Zapier, Make, or Power Automate workflow is a chain of standing OAuth grants, built by one person and running unattended.
- OAuth grant auditAn OAuth grant audit reviews every app authorized to access your workspace data and revokes the grants that should not still exist.
- OAuth scope creepOAuth scope creep is when apps keep permissions far broader than their function needs because nobody reviewed the grant after setup.
- SaaS application registryA SaaS application registry is the maintained inventory of every tool in use: owner, function, data types, and agreements.
- SaaS data backupYour SaaS vendors keep their platforms running; keeping your data recoverable is contractually your job, and most companies haven't done it.
- SaaS offboardingSaaS offboarding closes a leaver's access in every application, including the tools outside SSO that the directory never touches.
- SaaS spend wasteSaaS spend waste is recurring cost with no return: unused licenses, abandoned subscriptions, and overlapping tools nobody tracks.
- SaaS-to-SaaS integrationsSaaS-to-SaaS integrations are app-to-app connections that run on tokens and API keys no person owns and offboarding never touches.
- SCIM provisioningSCIM automatically creates, updates, and deactivates SaaS accounts from your directory, removing manual joiner-mover-leaver steps.
- shadow SaaSShadow SaaS is every app employees use without IT review, unknown to the people responsible for securing it.
- vendor decommissioningCancelling a SaaS contract ends the invoices; the vendor's grants, tokens, and your data on their side all need closing separately.
the AI.
Assistants, agents, connectors and notetakers, and the data they reach through permissions they inherit.
- agentic AI and over-accessAgentic AI over-access is when an AI agent holds permissions far beyond what its task requires.
- AI acceptable use policyAn AI acceptable use policy names approved tools, the data that must stay out of external AI, and how to get new tools reviewed.
- AI browser extensionsAI browser extensions can read open tabs, typed text, and clipboards, and most access reviews never see them.
- AI connectors and MCPAI connectors and MCP servers give assistants standing access into mail, files, and business tools, each connection a new access path.
- AI data leakageAI data leakage is company data entering external AI models without a DPA, a terms review, or any record that it happened.
- AI hallucinationsAI hallucinations are confident, incorrect model outputs; governance means catching them before they leave the organization.
- AI meeting notetakersAI notetakers join calls under one person's standing OAuth grant and turn every meeting they touch into stored, searchable text.
- AI tool vettingAI tool vetting is a consistent review of data terms, training policies, residency, and certifications before a tool is approved.
- AI training on company dataMany free and consumer AI tiers may use your inputs to train their models; enterprise tiers typically disable this.
- AI usage visibilityAI usage visibility is knowing which AI tools are in use, by whom, through what channels, and with what access to company data.
- Copilot and enterprise-search oversharingAI assistants like Copilot surface every file existing permissions allow, which makes years of quiet oversharing suddenly searchable.
- EU AI ActThe EU AI Act sets risk-based obligations for AI providers and deployers, including organizations that simply use AI at work.
- prompt injectionPrompt injection hides attacker instructions in content an AI system processes, redirecting what the system does.
- shadow AIShadow AI is AI tools used at work without IT review, approval, or documentation.
identity & access.
Leavers, contractors, admins, service accounts, sessions and the reviews meant to catch all of them.
- access reviewsAn access review is a periodic process where resource owners confirm that every account with access to a system still needs it.
- API key rotationAPI keys are long-lived credentials that grant access with no login and no MFA; rotation and an inventory bound the exposure.
- contractor accessContractor access is any credential granted to an external person for a defined engagement; it should expire when the contract ends.
- external and guest file sharingAnyone-with-the-link shares and guest accounts are access grants at the file layer, unauthenticated, unexpiring, and almost never reviewed.
- identity sprawlIdentity sprawl is the same person holding uncoordinated accounts across many systems, with no single view of who has access to what.
- MFA gapsAn MFA gap is any account or access path where a second factor is not required, leaving credentials as the only barrier.
- offboarding accessOffboarding access means removing every credential, permission, and integration a leaver held, not just their directory account.
- orphaned accountsAn orphaned account is any login that stays active after the person it belongs to has left the organization.
- privilege creepPrivilege creep is the gradual accumulation of permissions that were never revoked when the reason for them ended.
- privileged access management (PAM)Privileged access management (PAM) is the set of controls around admin accounts: who holds them, how they're used, how they're revoked.
- service accountsA service account is any credential used by an application, script, or integration rather than a person; most go unreviewed.
- session and token theftToken theft steals the proof of a finished login, so the attacker arrives already authenticated, MFA included.
- shared admin accountsA shared admin account is one high-privilege login used by several people, which removes accountability for every action taken with it.
Looking for a number to put in front of your team? All the verified numbers, with sources →