A go-to-market model where individual users adopt a product first, often through free trials or self-service sign-up, and enterprise expansion follows later. In security terms, it can bypass traditional procurement and create shadow IT if teams do not track what employees are connecting to corporate data and identity systems.
Expanded Definition
Bottom-up GTM is a distribution model, not a security control. Its defining feature is that adoption starts with individuals or small teams using a product directly, then spreads into broader organisational use as value becomes visible from the inside. That differs from top-down sales, where procurement, security review, and formal ownership usually precede deployment.
From a security perspective, the boundary matters because bottom-up adoption often begins outside central visibility. Teams may connect the product to corporate email, documents, source code, or collaboration systems before security, procurement, or architecture teams have assessed the data flow. The result is not automatically unsafe, but it can create unmanaged integrations and inconsistent approval paths. NHI Management Group treats this as a governance and discovery problem first, then a control problem.
A useful distinction is that bottom-up GTM describes how buying happens, while shadow IT describes what the organisation cannot see or govern. The two often overlap, but they are not identical. An approved self-service product can still be bottom-up; an unsanctioned tool can be shadow IT even if it was never marketed that way. Where machine access or delegated automation is involved, the security meaning becomes sharper because the product may gain access that outlives the original user trial.
Examples and Use Cases
Bottom-up GTM is common in products that make first-use easy and value obvious. In practice, it appears in workflows where one user can create an account, test the product, and invite colleagues before any formal rollout happens.
- A design team starts using a cloud file-sharing tool because it is easy to trial, then later routes sensitive project files through it.
- A developer installs a collaboration app that integrates with source control or CI/CD tools, creating a new access path that was not reviewed centrally.
- A department adopts an AI productivity service through individual sign-up, then connects it to company content or internal documents.
- An operations team begins with a free workflow platform and later automates notifications or data syncs into core business systems.
The tradeoff is speed versus visibility. Bottom-up adoption can surface real demand faster than formal procurement, but it also fragments oversight unless organisations track what is being connected, by whom, and with what permissions. For a broader security context on identity-bound access created outside the usual purchase path, the OWASP Non-Human Identity Top 10 is useful when the product creates or relies on machine-mediated access.
Security Implications
The main security issue with bottom-up GTM is that adoption can outpace governance. When users can connect new services before security review, organisations may lose track of where data is stored, which identities have access, and whether a vendor has been approved to process sensitive information. That creates exposure across confidentiality, compliance, and incident response.
Misunderstood bottom-up adoption often produces three failure modes: unvetted data sharing, over-permissioned integrations, and orphaned access after pilots end. A tool that began as a harmless trial may later hold corporate content, support chat logs, API tokens, or delegated access to SaaS systems. If no one owns the service lifecycle, security teams may not know when to revoke access or disable stale connections.
The practitioner reality is that the highest risk is often not the initial download or sign-up, but the quiet moment when a user connects the product to a trusted corporate system. That is where an ordinary adoption story becomes an access-control and data-governance problem.
Domain and Governance Relevance
In cybersecurity, bottom-up GTM matters because it changes the order in which trust is granted. Security teams are no longer only evaluating a vendor before rollout; they are also discovering tools after users have already created real dependencies. That shifts governance from gatekeeping to ongoing discovery, approval, and review.
For identity and access governance, the issue becomes more specific when bottom-up products create service accounts, OAuth grants, API keys, or agent-like automations that continue operating after the original user stops paying attention. At that point, the control question is not just whether the software is approved, but whether the identity behind its access is inventoried, scoped, and revocable.
Bottom-up GTM therefore sits at the intersection of user adoption, SaaS governance, and access visibility. Organisations that treat it only as a sales strategy miss the operational reality that informal adoption can become formal dependency very quickly.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM — Asset Management | Bottom-up adoption creates software and integration assets that often appear before central inventory. |
| PR.AC — Identity Management, Authentication and Access Control | User-led sign-up can create unreviewed access paths into corporate systems. | |
| Recommendation — Maintain an inventory of user-adopted SaaS and integrations before they become unmanaged dependencies. Enforce access approval and least privilege for any tool connected to corporate data or identity systems. | ||
| CIS Controls v8 | 6 — Access Control Management | Bottom-up GTM often leads to ungoverned accounts, grants, and stale access. |
| 15 — Service Provider Management | Self-serve adoption still creates third-party exposure that needs vendor oversight. | |
| Recommendation — Revoke or scope unapproved access paths created by self-service product adoption. Assess vendors once their products begin handling company data, even if adoption started informally. | ||
| MITRE ATT&CK | T1199 — Trusted Relationship | Bottom-up adoption can exploit trusted user behaviour to extend access into enterprise systems. |
| Recommendation — Hunt for trusted-relationship abuse when users introduce new tools into core workflows. | ||
