A sales team starts using a free AI writing tool. Marketing opens another file-sharing account for a campaign. A project manager pays for a planning app on a personal card because the approved system feels slow.
These choices often solve an immediate problem. Yet they can create shadow IT, software and services that sit outside normal IT, finance, and security oversight. That includes SaaS accounts, browser extensions, personal devices, integrations, free trials, and apps connected with employee logins.
A good shadow IT audit finds what is in use, where data goes, and which tools deserve approval, replacement, or removal.
What Shadow IT Is and Why It Needs an Audit
Shadow IT is any technology used for work without formal approval or proper visibility. It has grown because cloud software takes minutes to buy, remote staff need quick answers, and free AI tools are always one search away.
Most employees are not trying to sidestep security. They are trying to share files, automate repetitive work, speak to customers, or meet a deadline. Treating every unapproved app as misconduct will only drive use further underground.
An approved app has passed the organisation’s review process and has an owner. An unauthorised app has not been assessed or accepted. A tolerated app sits in the grey area, perhaps known to a team but missing a contract, security check, or named owner.
An audit replaces assumptions with evidence. It gives IT and business teams a reliable picture of the software estate without turning the exercise into a blame campaign.
The Unapproved Apps Hiding in Everyday Work
Shadow IT is often less obvious than a full software platform. A business might know about a department’s Salesforce or HubSpot account, yet miss the browser add-on that copies prospect data into another service.
Common examples include:
- File-sharing tools, messaging apps, online form builders, meeting platforms, CRM systems, automation services, and personal email accounts.
- Generative AI assistants used to summarise customer calls, draft proposals, translate documents, or analyse spreadsheets.
- Browser extensions that read webpage content, record meetings, manage passwords, or connect with social media.
- Personal Dropbox, Google Drive, WhatsApp, or Microsoft accounts used for work files and conversations.
OAuth connections deserve close attention. When a user clicks “Sign in with Google” or “Continue with Microsoft”, they may grant an app access to mailboxes, contacts, calendars, files, or profile data.
API tokens create another blind spot. A former contractor may still have a token that links an automation tool to a company system. Duplicate accounts, temporary staff, and abandoned trial accounts also make access harder to track.
How Shadow IT Raises Costs and Security Risks
The financial damage is often plain once the full list is visible. Different teams may pay for multiple video platforms, e-signature tools, project boards, or survey products with similar features.
Costs also hide in unused licences, automatic renewals, duplicate subscriptions, and usage-based plans that grow without anyone watching. A free trial can become a paid account after one forgotten renewal date.
Security risks are broader. An unreviewed app may lack multi-factor authentication, use weak password controls, give users excessive permissions, or have unclear data retention practices. Staff may upload confidential files or personal data to AI and file-sharing tools without knowing where that information is processed.
A tool can be useful and still be unsafe for the data placed in it.
UK organisations must consider the UK GDPR and the Data Protection Act 2018 when personal data is involved. Contracts with customers may also restrict where data is stored and which sub-processors can access it. Irish and EU businesses may have extra sector duties, including NIS2 and the Digital Operational Resilience Act (DORA), where those rules apply.
How to Run a Shadow IT Audit From Discovery to Action
Set the scope before gathering data. Include office staff, home workers, contractors, mobile devices, browser extensions, cloud apps, connected integrations, and business systems accessed with personal accounts.
The goal is not to build a long spreadsheet and file it away. You need to identify each application, its owner, the information it handles, its cost, and the action required.
Bring in IT, security, finance, procurement, legal or data protection colleagues, plus department leads. Each group sees a different part of the picture.
Find Unapproved Software Across the Business
No single source will reveal every app. Finance and procurement records identify paid subscriptions, invoices, reimbursements, and upcoming renewals. However, they miss free services and software bought with personal cards.
Identity and access data can reveal far more. Review Microsoft Entra ID or Okta sign-ins, Microsoft 365 reports, Google Workspace activity, and single sign-on records. These sources show who accessed which applications, although they may not capture services that do not use company sign-in.
DNS, web proxy, and secure web gateway logs can show SaaS domains visited from managed networks. Endpoint management platforms can identify installed software, while browser management can surface extensions and their permissions.
A short staff survey adds context that logs cannot provide. Ask what tools people use, what problem each one solves, whether company data goes into it, and whether a contract exists. Keep the questions practical and make clear that the exercise is about safer working, not punishment.
Build a Complete Application and Licence Inventory
Record every discovered tool in one inventory, including apps that are free, inactive, duplicated, or under trial. Department leads should validate the entries before decisions are made.
Useful fields include:
| Record | Details to capture |
|---|---|
| Ownership | Supplier, business owner, department, active users |
| Commercials | Cost, licence type, renewal date, contract terms |
| Data | Data types stored, hosting location, retention terms |
| Access | SSO status, MFA, admin roles, OAuth permissions |
| Connections | Integrations, API tokens, linked systems |
| Purpose | Business use, alternatives, business importance |
Separate user accounts from licences where possible. A company may hold 80 licences for a tool but have only 45 active users. It may also have five different accounts with the same supplier, each owned by a different team.
Score Each App by Risk, Value, and Cost
A simple scoring model makes the inventory useful. Assess data sensitivity, number of users, access permissions, supplier security, business importance, regulatory impact, and potential breach exposure.
High-risk apps handling customer data, financial records, health information, confidential documents, or source code need prompt review. A low-cost app can still pose a serious problem if it has access to mailboxes or cloud storage.
Pair risk with business value and total cost of ownership. A tool that a team depends on may deserve formal approval, stronger controls, and a proper contract. Removing it without a replacement could create disruption and encourage staff to find another workaround.
Use clear categories:
- Keep and approve where the app has strong value and acceptable controls.
- Review and reduce where licences, permissions, or costs need attention.
- Replace where an approved tool can meet the same need.
- Block where risk is too high or the supplier cannot meet requirements.
Turn Audit Findings Into Lower Costs and Safer Software Use
The audit starts the work. Savings and risk reduction come from decisions, ownership, and follow-through.
Create an action list with deadlines and named people. Sort urgent access issues ahead of long-term software consolidation. That prevents a useful review from becoming another report nobody acts on.
Remove Duplicate Tools and Recover Unused Spend
Compare overlapping tools by active users, essential features, data held, integration needs, contract restrictions, and renewal dates. The cheapest tool is not always the right choice if moving data creates more risk or effort.
Reclaim inactive licences first. Then cancel forgotten trials, reduce licence tiers where appropriate, and consolidate teams onto approved platforms. Check annual contracts well before auto-renewal windows close.
Track savings from recovered seats and avoided renewals. Also account for short-term migration, training, and change-management costs. A cheaper subscription offers little value if staff lose a process they rely on.
Fix High-Risk Access and Data Exposure
Act quickly where an app has sensitive data or broad access. Remove unnecessary administrator rights, require multi-factor authentication, close orphaned accounts, and review OAuth grants.
Rotate exposed API keys and revoke tokens connected to former staff or unsupported services. Where staff used an unsafe file-sharing or AI tool, establish what company data was uploaded. Record the facts, preserve relevant evidence, and follow the organisation’s incident process if required.
Export needed information before closing accounts, then delete data according to contract terms and retention rules. Move valid business work into an approved system so teams do not lose access to important records.
Create a Clear Path for App Approval
People will keep finding new tools. A slow approval process makes unsanctioned sign-ups more likely, so offer a quick route for low-risk requests.
A request should capture the business need, data classification, supplier details, expected users, cost, integrations, and named owner. Security, privacy, procurement, and contract checks should match the risk level.
Maintain an approved app catalogue so staff can see what is already available. Give exceptions expiry dates, and include app access in starter and leaver checklists. Clear rules are easier to follow than a policy hidden in a shared drive.
Tools and Controls That Keep Shadow IT Under Control
Tools help with visibility, but they do not replace trust, policy, and regular review. Choose technology based on coverage, data handling, integration quality, support, and total cost.
Microsoft Defender for Cloud Apps can identify cloud app use and apply access controls in Microsoft-focused environments. Microsoft Entra ID, Google Workspace reporting, and Okta can provide identity and sign-in evidence.
Platforms such as Netskope offer cloud access security broker capabilities. BetterCloud, Torii, and Zylo focus on SaaS management functions such as discovery, licence visibility, workflows, and spend control. Each needs careful assessment against the organisation’s requirements.
Choose Tools That Fit Your Business
A small business may start with finance data, Microsoft 365 or Google Workspace reports, identity logs, and a well-maintained spreadsheet. That approach works when the application estate is modest and someone owns the review.
Dedicated SaaS management or CASB platforms become more useful when teams use hundreds of apps, licences change often, or access reviews take too long. Look for SaaS discovery, SSO integration, spend analysis, vendor assessment records, risk scoring, workflow automation, and remediation support.
Ask suppliers where they host data, how long they retain it, who can access it, and whether UK or EU hosting is available. Also check implementation effort. A platform that nobody maintains will not solve the visibility problem.
Monitor New Apps Without Blocking Useful Innovation
Review application discovery monthly and access rights quarterly. Add renewal alerts, browser and endpoint monitoring, and notifications for risky OAuth permissions.
Policies should state which apps staff can use freely, which require approval, and which are prohibited. Give teams safe options for experimentation, especially with AI tools, so useful ideas can move into controlled use.
Automation can route requests, collect supplier evidence, notify owners, and flag risky permissions. Human review still matters where sensitive data, complex integrations, or contractual obligations are involved.
Common Shadow IT Audit Mistakes to Avoid
An audit fails when it focuses only on paid software, blocks every unfamiliar app, or ignores why staff chose a tool. It also fails when nobody owns the follow-up.
Transparency and proportionate controls build better habits than surprise restrictions. Tell staff what data you are reviewing and how findings will be used.
Do Not Treat Employees as the Problem
Staff often choose unsanctioned tools because approved systems are slow, hard to use, or missing needed features. Ask what each app helps them achieve before removing it.
Offer an approved alternative where possible and explain restrictions in plain language. Focused training on passwords, phishing, data sharing, AI use, and reporting mistakes gives people practical help.
Do Not Stop After the First Inventory
Software use changes every week as people start trials, connect integrations, and change suppliers. Repeat discovery at least quarterly and after major business changes.
Track unknown apps found, high-risk apps remediated, licences recovered, renewal savings, approval time, and adoption of approved tools. These measures show whether controls are working.
Conclusion
A shadow IT audit exposes wasted spend, risky access, and business needs that existing systems have failed to meet. Start with finance records, identity data, SaaS usage, and conversations with the people doing the work.
Then assess each app, remove waste, fix unsafe access, and make approval straightforward. Controlled software use gives staff the tools they need without leaving costs and sensitive data out of sight.
Leave A Comment