What shadow IT is
Shadow IT is any hardware, software or cloud service being used for work without IT approval or knowledge. Most of it today is SaaS someone signed up for with a work email, which is why IT asset management now has to cover subscriptions and not only hardware.
Category: IT Asset ManagementOpen IT Asset Management
What shadow IT means
Shadow IT is technology used for work that IT has not approved, procured or inventoried. It covers unsanctioned SaaS accounts, personal cloud storage holding company files, departmental tools bought on a corporate card, unmanaged devices on the network, and scripts or automations a team maintains privately.
What shadow IT looks like
The classic image of a server under a desk is now the rare case. The common one is a marketing manager signing up for a transcription service with a work email and a free tier, a finance analyst sharing a workbook from personal Google Drive, or an engineer pasting production data into an AI assistant that nobody has reviewed.
None of these involve rule-breaking in the user's mind. They happen because the sanctioned tool is slower to obtain than the unsanctioned one, which is why a shadow IT problem is usually a procurement-speed problem wearing a security costume.
How to find shadow IT
Four sources cover most of it, and they find different things.
- Identity provider sign-in logs. Okta and Microsoft Entra ID record every app a work identity authenticates to, including apps nobody configured.
- Card and expense data. Recurring low-value charges to unfamiliar vendors are the fastest route to departmental SaaS.
- Network and DNS egress logs. These show unsanctioned services and unmanaged devices, though not who is using them.
- Agent-based app inventory. An RMM or UEM agent reports installed software per endpoint, which catches desktop tools the other three miss.
Why shadow IT matters commercially
Three exposures tend to drive the budget for dealing with it. There is no data processing contract with the vendor, which under GDPR Article 28 is a requirement rather than a nicety when personal data is involved. There is no offboarding, so a leaver keeps their login because the account never touched your identity provider. And spend duplicates, since two departments buy overlapping tools and both renew automatically.
On the hardware side, discovery is a priced feature. Lansweeper Starter is $239 per month for up to 2,000 assets, checked 2026-03-17, scanning the network for devices nobody enrolled. The IT asset management savings calculator is a quick way to test whether recovered licences cover that before you take it to finance.
Reducing shadow IT
The controls that work are boring. Require SSO for anything holding company data, so an unsanctioned tool is visible the first time someone logs in. Give procurement a published path with a short turnaround for small purchases. Publish an approved list that includes a sane default for the common jobs people go looking for.
Enforcement alone moves shadow IT further out of sight rather than removing it. The GLPI and Lansweeper comparison covers the discovery side of the problem; the policy side belongs to whoever owns procurement, not the service desk.
Shadow IT questions
What is an example of shadow IT?
A team paying for a project tool on a corporate card without telling IT, staff sharing work files from personal cloud storage, or an unapproved AI assistant handling customer data. All three put company data somewhere IT cannot see, contract for or revoke.
Why is shadow IT a security risk?
Because the account sits outside your identity provider. There is no enforced multi-factor authentication, no central deprovisioning when someone leaves, no logging you can audit, and no data processing agreement with the vendor. The data itself may be fine; the lack of a revocation path is the problem.
How do you detect shadow IT?
Start with identity provider sign-in logs and corporate card data, which between them surface most unsanctioned SaaS. Add network or DNS egress logs for unmanaged devices and services, and agent-based software inventory for desktop applications the other sources miss.
Is shadow IT always bad?
No. It is a signal that a real need is being met faster outside the approved path, and some of those tools are worth adopting. The risk is the absence of contracts, access control and offboarding, not the software choice itself.
Related Shadow IT resources
Asset discovery is the technical half of finding shadow IT, and BYOD is the sanctioned version of the same instinct. Both definitions sit next to this one.