in one lineShadow IT discovery is the structured process of finding every unmanaged app, account, and integration in your environment.
the numbers
- 1,000+believed under 10 apps vs 1,000+ actualAppOmni, 2024
- 305SaaS applications in the average organisationZylo SaaS Management Index, 2026
- 48%of SaaS applications sit outside IT's managementProductiv State of SaaS, 2024
1what shadow IT discovery actually means
Shadow IT discovery is the structured process of finding technology that exists in your company's environment outside of IT governance. The output is an inventory: apps, integrations, accounts, devices, and AI tools that are in use but unmanaged.
Discovery is distinct from remediation. The goal at this stage is visibility: knowing what is there before deciding what to do about it. An accurate inventory is the prerequisite for every control that follows, whether that is an access review, a policy update, an offboarding process, or a compliance audit.
A discovery exercise captures a point-in-time picture; shadow IT accumulates continuously, in proportion to organizational activity. Sustained visibility requires a repeatable process or a tool that maintains the inventory automatically.
2why shadow IT builds up faster than IT can track it manually
Shadow IT accumulates because the friction of adopting a tool is now lower than the friction of submitting a procurement request. A team that needs a project tracker, a transcription tool, or an AI assistant can have one running in minutes on a personal or trial account.
IT teams fall behind because adoption patterns changed underneath them. SaaS made it frictionless to add tools. AI made it invisible. Browser extensions do not appear in procurement records. Personal accounts do not appear in the directory. OAuth grants do not require IT approval to be created.
By the time a formal discovery exercise runs, in most growing companies, the gap between the approved list and the actual stack is substantial.
3what you don't find can still be found by someone else
Unmapped shadow IT creates exposure that is difficult to scope until after an incident. An active account belonging to a former employee is an attack surface you don't know you have. An OAuth grant connected to a shadow SaaS app gives that app access to your mailboxes or documents until someone reviews and revokes it.
IBM research puts the average time to identify and contain a breach at 241 days. The longer your environment goes unmapped, the more time any given exposure has to be used.
Beyond breach risk, undiscovered shadow IT creates compliance gaps. GDPR requires you to account for where personal data is processed. NIS2 and DORA extend control requirements to third-party relationships. If you cannot produce an accurate inventory, you cannot demonstrate compliance, and you cannot answer the security questionnaire an enterprise client sends before signing a contract.
what it looks like when it goes wrong
Three ways this tends to go, each one taken from a real case.
- it happenedSalesloft / Drift, 2025howA chat tool's key into your CRM is stolen from the vendor.what leavessupport tickets, including passwords pasted into themwho ends up with itan extortion group working through hundreds of companies
- it happenedGitHub OAuth tokens, 2022howIntegration keys to your code host are stolen from the integration vendor.what leavesyour private code and the secrets inside itwho ends up with itattackers looking for the next door
- it happenedSisense, 2024howAn analytics vendor is breached and the keys it holds to your systems are copied.what leavesconnections straight into your datawho ends up with itwhoever holds the vendor's keys
4what works
No single method is complete, so discovery that holds up combines several views and lets them check each other. The highest-signal source in a cloud-first environment is OAuth grant enumeration: a read-only connection to the IdP lists every third-party application granted access, surfacing shadow SaaS connections, AI tools, and forgotten integrations in one pass. Web traffic adds what the directory cannot show. Outbound DNS and proxy logs reveal the domains employees visit consistently; anything off the approved list is a candidate for investigation, which is how browser-based tools that leave no directory trace get caught.
The expense trail catches a third population. Company card statements and expense claims reconciled against the approved list surface subscriptions IT never approved, in direct evidence rather than inference. Where an MDM or endpoint tool exists, it shows what is installed on enrolled devices, though browser extensions need their own policy or tooling to surface. And structured conversations with team leads, positioned as support rather than audit, catch the tools that leave no financial or technical trace at all; teams will name the software they cannot work without, and the names regularly include tools IT has never seen.
The comparison across lists is where discovery earns its keep. A tool in the OAuth list but absent from finance is running on a free tier or a personal card. A tool finance pays for with no OAuth connection is a standalone account offboarding will never reach. A tool on the approved list that appears in neither is a license someone pays for and nobody uses. Each mismatch is a finding, and none of them is visible from any single list alone.
your turn
what you can do about it
this week
Pull software lines from expenses and new app sign-ins from your identity provider.
Put both on one list, and you have your first inventory.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →