Unauthorised software is any application or service used without the organisation’s consent or security review. It can create hidden access paths, data leakage risks, and compliance issues because it may not follow corporate controls. In practice, it is a major driver of shadow IT and unmanaged operational risk.
Expanded Definition
Unauthorised software is any application, utility, browser extension, agent, or hosted service that enters the enterprise without approval, security review, or lifecycle ownership. In NHI and IAM environments, the term matters because software often brings its own identities, tokens, API keys, and outbound connections, which can bypass normal controls. Definitions vary across vendors, but the practical security test is simple: if the organisation cannot verify who approved it, what data it touches, and what credentials it uses, it is unauthorised.
This differs from sanctioned software with weak configuration. A managed but misconfigured tool still sits inside governance processes, while unauthorised software exists outside them and can create hidden trust paths, unsupported integrations, and unmonitored secret exposure. For that reason, it is commonly discussed alongside shadow IT, shadow AI, and unmanaged SaaS. NIST SP 800-53 Rev. 5 security controls provide a useful baseline for assessing whether software acquisition, access, and monitoring are being governed, even when the software itself was never meant to be present.
The most common misapplication is treating any unapproved app as harmless “productivity software,” which occurs when employees install tools that sync files, store tokens, or connect to internal systems without review.
Examples and Use Cases
Implementing controls for unauthorised software rigorously often introduces friction for end users, requiring organisations to weigh speed of adoption against visibility, data protection, and identity governance.
- An engineer installs an AI coding assistant that scans repositories and uploads prompts to an external service, creating unreviewed data egress and potential secret exposure.
- A finance team adopts a file-sharing app outside procurement, and the service creates new OAuth grants that security teams cannot inventory or revoke cleanly.
- A browser extension requests broad permissions, reads internal web applications, and silently captures session data or API tokens from authenticated workflows.
- A low-code automation tool is connected to production systems without review, introducing unmanaged service accounts and long-lived credentials into operational pipelines.
- An unapproved SaaS platform is used to coordinate contractors, but no one can confirm where files are stored or whether the provider meets retention and access requirements.
These patterns are visible in NHIMG research on the Ultimate Guide to NHIs, which shows how unmanaged identities and secrets turn ordinary software adoption into security exposure. The same control logic is reinforced by NIST SP 800-53 Rev 5 Security and Privacy Controls, especially where organisations need asset inventory, access review, and continuous monitoring discipline.
Why It Matters in NHI Security
Unauthorised software becomes an NHI problem because modern applications rarely operate alone. They create service accounts, store secrets, call APIs, and exchange data with cloud services and internal systems. When that software is invisible to governance, its identities are also invisible, which undermines least privilege, secret rotation, offboarding, and incident response. NHIMG research shows that only 5.7% of organisations have full visibility into their service accounts, and 79% have experienced secrets leaks, with 77% of those incidents causing tangible damage. Those numbers highlight how quickly an unreviewed tool can become an identity compromise rather than a simple policy issue.
Unauthorised software also weakens compliance posture because control owners cannot prove what is running, where data is flowing, or which credentials are embedded in the toolchain. That creates audit gaps, unmanaged third-party risk, and ambiguous accountability when access must be revoked. NHI governance therefore treats software approval as an identity control, not only a procurement or endpoint control, because the software often brings the identities that attackers exploit. Organisaties typically encounter the operational impact only after a breach investigation, at which point unauthorised software is no longer a policy exception but an urgent containment problem.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Unauthorised software often introduces unmanaged NHIs and secret sprawl. |
| NIST CSF 2.0 | ID.AM-1 | Software inventory is foundational to identifying unauthorised applications. |
Inventory every software-linked identity and block tools that cannot prove ownership or lifecycle control.
Related resources from NHI Mgmt Group
- What fails when organisations only scan endpoints occasionally for unauthorised software?
- How should security teams handle exposed secrets in modern software pipelines?
- What is the difference between software supply chain risk and NHI risk?
- Why do leaked secrets need a different reporting path than ordinary software bugs?
