Somewhere in your company right now, a marketing coordinator is running campaign data through a scheduling tool that finance never approved. A sales rep connected a personal Zapier account to the CRM last quarter to save fifteen minutes a week. Someone in support has been pasting customer data into a free transcription tool because it's faster than the ticketing system's built-in notes field.
None of these people are trying to cause a problem. They're trying to get their job done, and the tool they picked over a company credit card was the path of least resistance. That's shadow IT: software running inside your business that IT and security never signed off on, and in most companies it's a much bigger footprint than anyone in leadership assumes.
Photo by Akshar Dave🌻 on Pexels
What Shadow IT Actually Looks Like Inside a Growing Company
Shadow IT rarely shows up as one dramatic rogue system. It shows up as dozens of small, individually reasonable decisions. A project manager signs up for a Kanban tool with a free tier because the approved project management software is clunky. An engineer spins up a personal cloud storage bucket to share large files with a contractor. A finance analyst builds a reporting dashboard on a no-code platform because getting a new report from the data team takes three weeks.
Each of these tools solves a real, immediate problem. That's exactly why banning them outright rarely works, and why the first step in dealing with shadow IT is understanding it, not punishing it.
The pattern tends to concentrate in a few departments: marketing (analytics widgets, social scheduling, landing page builders), sales (prospecting tools, call recording, personal automation), and operations (spreadsheet-adjacent no-code apps that quietly become mission critical). Engineering teams have shadow IT too, usually in the form of personal API keys, unsanctioned browser extensions, or a staging environment nobody remembers to decommission.
Why It Multiplies Faster Than Anyone Notices
Three forces make shadow IT grow quietly instead of loudly.
Free tiers remove the approval step. A tool that would have required a purchase order five years ago now just needs a work email address. No procurement review, no security questionnaire, no paper trail for anyone to catch later.
Credit cards bypass procurement entirely. A team lead expenses a $19-a-month subscription and nobody outside that team ever sees an invoice with the vendor's name on it. Multiply that across departments and years, and companies routinely discover they're paying for two or three overlapping tools that do the same thing, none of which show up on a single master list.
Integrations create invisible data pathways. The tool itself might be harmless, but the moment someone connects it to a CRM, a spreadsheet full of customer records, or an internal API, data starts moving to a system that was never assessed for how it stores or secures that data.
Photo by Gustavo Fring on Pexels
The Real Risks: Security, Compliance, and Data Integrity
Security Exposure
Unapproved tools rarely go through a security review, which means nobody has checked how they store credentials, whether they support single sign-on, or what happens to your data if that vendor gets breached. The Cybersecurity and Infrastructure Security Agency has published extensive guidance on exactly this class of risk, and one of its recurring findings is that organizations can't defend systems they don't know exist. You can read more of that guidance at CISA. The National Institute of Standards and Technology also maintains widely used frameworks for asset inventory and risk categorization that apply directly to an unmanaged tool list.
Compliance Gaps
If your company handles regulated data, whether that's healthcare records, payment information, or EU customer data, every unsanctioned tool that touches that data is a potential compliance failure. Auditors don't accept "we didn't know that tool existed" as an answer, and neither do regulators. The Wikipedia entry on shadow IT is a reasonable starting point for understanding how broadly this term is now used across security and compliance literature.
Data Integrity and Duplication
When three teams each keep their own version of a customer list in three different tools, nobody has the real picture. Reports disagree, marketing sends the wrong message to the wrong segment, and support answers questions with stale information. This is often the quietest cost of shadow IT: not a breach, just a slow erosion of trust in your own data.
How to Discover What's Already Running
You cannot fix what you haven't found, and discovery is usually easier than teams expect once they know where to look.
- Expense reports and corporate card statements surface most of the recurring SaaS subscriptions nobody formally approved.
- Single sign-on and identity provider logs show which external services employees are authenticating into with their work accounts. Identity platforms like Okta publish decent guidance on using SSO adoption data as a discovery tool, since every login attempt against an unmanaged app leaves a trace even before that app is brought under formal SSO.
- Network and DNS traffic logs catch tools that don't use SSO at all.
- A short, blame-free survey asking "what tools do you use that IT didn't set up for you" gets surprisingly honest answers when people understand it's about visibility, not punishment.
Run all four in parallel rather than picking one. Expense reports miss free-tier tools. SSO logs miss anything authenticated with a personal email. The survey misses tools people have simply forgotten they're using. Together they build a picture that's close to complete.
Building an Inventory Without Turning It Into a Witch Hunt
The single biggest mistake companies make when they discover the scale of their shadow IT is treating the rollout like an investigation. That guarantees the next round of shadow IT goes further underground, with people actively hiding tools instead of just not mentioning them.
A better approach: announce an amnesty period. For thirty days, anyone can register a tool they're using without any negative consequence, no matter how long it's been running or what data it touches. The goal in this phase is a complete list, not a clean one. You sort out what stays, what gets replaced, and what gets shut down after you actually know what you're dealing with.
Photo by Anete Lusina on Pexels
Setting Guardrails That Don't Kill Productivity
Once you have a real inventory, the fix isn't a longer list of banned tools. It's making the approved path faster than the workaround.
Create a self-serve procurement lane for low-risk tools under a certain dollar threshold, with a same-day security checklist instead of a three-week review cycle. Most shadow IT isn't malicious, it's impatient.
Require SSO for anything touching company data, and make that requirement part of the vendor selection process from the start rather than a retrofit. Tools that can't support SSO get flagged automatically as higher risk.
Maintain one visible, current list of approved tools per function, so a new hire on the marketing team can find a sanctioned scheduling tool in thirty seconds instead of reaching for whatever their last company used. If your existing systems don't talk to each other well enough to make that list trustworthy, that's usually a sign the underlying data integration service work needs attention before the governance policy will actually hold.
For companies with security frameworks already in place, OWASP's resources are worth cross-referencing when you set technical requirements for any newly approved tool; their project index covers authentication, session handling, and data storage guidance that applies well beyond web applications specifically.
When Shadow IT Signals a Deeper Gap in Your Tooling
Not every instance of shadow IT is a discipline problem. Sometimes it's the clearest signal you'll get that an approved system doesn't actually meet the team's needs. If four different people on four different teams have all independently started using the same unapproved reporting tool, that's not four people ignoring policy. That's four people telling you, in the most direct way they know how, that the approved reporting tool is too slow or too limited.
Treat repeated, independent adoption of the same unsanctioned tool as a product requirement, not just a risk to shut down. The fix might be replacing the official tool, not enforcing better compliance with a bad one.
Photo by RDNE Stock project on Pexels
Governance That Sticks: Roles, Review Cadence, and Metrics
A shadow IT initiative that ends after the amnesty period and the initial cleanup will be back to square one within a year. What keeps it from recurring is ongoing, lightweight governance:
- Assign clear ownership. Someone specific, not "IT" as an abstract department, owns the tool inventory and the approval queue.
- Review quarterly, not annually. SaaS sprawl moves faster than an annual audit cycle can track.
- Track a small number of metrics, like the count of newly discovered unsanctioned tools per quarter and the average time from tool request to approval. A rising discovery count usually means your approval process is still too slow, not that your employees are getting worse at following policy.
"Most shadow IT audits I've been part of don't find a rogue actor, they find a procurement process nobody trusted to move fast enough. Fix the speed problem and the compliance problem mostly fixes itself." - Dennis Traina, founder of 137Foundry
Making This Part of How the Company Operates
Shadow IT isn't a project with an end date. It's an ongoing byproduct of a company that's growing, hiring, and giving people the latitude to solve their own problems, which is generally a good thing. The goal was never to eliminate that instinct. It's to give it a fast, visible, well-lit path instead of a hidden one.
Start with discovery, run the amnesty period honestly, and then build the review cadence that keeps the inventory from going stale again. Companies that treat this as a one-time cleanup are back where they started within eighteen months. Companies that treat it as a standing practice tend to find that their tooling gets simpler and cheaper over time, not just safer.
If your team is trying to untangle overlapping tools, disconnected data, or integration work that's outgrown what the original stack was built for, 137Foundry's engineering team has spent a lot of time in exactly this kind of mess. Take a look at the full services hub or read more about how we work before reaching out.
