What is shadow IT? The risks, and how to find the assets you can't see
Contents
A SaaS tool a department signed up for on its own. A staging subdomain a dev team stood up. A cloud resource left behind by someone who has since left. All of them exist and are running, and none of them is in the IT department's inventory.
Shadow IT is the collective name for that: IT that grew without passing through the official route.
Shadow IT is an asset that runs but isn't on the list
Nothing here is switched off or broken. These things are in use, they are visible from outside, and the only place they don't exist is the list kept by the people responsible for them.
Figure 1: Running, and absent from the list
Deep dive: the scale is hard to state as a number
Plenty of figures circulate for the share of assets an organization doesn't know about, but each survey draws its population differently, so none transfers cleanly to your company. The reliable way to learn your own share is to run discovery from outside and reconcile the result against the inventory you hold.
Four reasons it appears, all of them people moving work forward
Faster than waiting for approval. Missed in a handover. Built faster than governance could keep up. Needed while working away from the office. None of it starts from bad intent, which is why a memo banning it doesn't reduce it.
Figure 2: Four entry points, and the circumstances behind each
Deep dive: when the weight of approval is the cause
If the sanctioned tool is awkward, or the gap between requesting access and having it is long, the incentive to route around it appears on its own. In that case, lightening the official path does more than tightening detection. Detection only ever finds what has already happened.
The real damage is not the asset; it's being unable to account for it
An asset that isn't listed is not defended, not inspected and not reported on. When something does happen, you cannot answer how far it reached.
Figure 3: The problem is one of visibility, not of the asset
Deep dive: the question you cannot answer
When a customer asks where their data is held, and it sits in a service that never made the inventory, there is no answer to give. Even with no incident, the inability to answer becomes a condition of doing business. Staying able to say what is where is one of the goals of the whole exercise.
You find it by looking from outside, not by asking inside
Asking people to declare what they use only surfaces what they consider declarable. Standing where an attacker stands and searching inward finds it without depending on anyone's judgment.
Figure 4: Relying on declarations versus searching from outside
Deep dive: what turns up when you search from outside
Starting from the organization's domain, discovery collects reachable subdomains, IP addresses, ports and technologies. Our piece on ASM covers the mechanics. Reconciled against the inventory, the result splits cleanly into known and never-seen.
After finding it, keep following it and put it in order
Treat it as a one-off audit and the same state returns within a month. New shadow IT appears daily, so discovery has to run continuously too.
Figure 5: A loop of four, rather than a single sweep
- What is Attack Surface Management (ASM)? Seeing your own assets from outside
- What is CTEM? How it differs from traditional vulnerability management
- Threat Exposure Risk: technical risk multiplied by business risk
- The window for leaving exposure alone has closed
Seeing what your own domain turns up is free to try for 14 days.
Appendix: what goes wrong, and what to do
Table 1: what happens when shadow IT is present
| What happens | Detail |
|---|---|
| You can't say where data lives | Company data sits in unmanaged SaaS, with access settings nobody has checked |
| The attack surface widens unnoticed | Unpatched servers and default-configured services end up facing outward |
| Detection arrives late | Nothing is watching, so there is no path by which an anomaly gets noticed |
| Blast radius can't be determined | With no record of what is where, investigation afterwards takes far longer |
Table 2: what ASM does about it
| Measure | Detail |
|---|---|
| External asset discovery | From a domain, collect subdomains, IPs, ports and technologies automatically |
| Continuous monitoring | Detect newly appeared assets as they show up |
| Automatic risk assessment | Assess vulnerabilities and misconfiguration, then order them by TER band |
| Change tracking | Keep additions, removals and changes on a timeline so unapproved changes surface |
You cannot defend what you cannot see — but seeing it is not the same as defending it either. The work ends when what was found has been ordered and cleared.
Visualize your attack surface with PentaTrail CTEM/ASM
From discovery to vulnerability validation and remediation — all powered by the CTEM framework.
Get Started
