Shadow IT discovery needs device, identity, and SaaS signals

At a glance

What this is: This is Fleet's guide to shadow IT discovery, with the central finding that single-signal inventory approaches miss unapproved software and services across distributed device fleets.

Why it matters: It matters because identity, endpoint, and compliance teams need a reliable baseline of installed software, SaaS usage, and access paths before they can govern risk, patch exposures, or investigate incidents.

Context

Shadow IT discovery is the problem of finding software, cloud services, and browser-based tools used for work without IT approval or visibility. The control gap is not just missing inventory, but missing ownership, patch coverage, and data-flow oversight across managed and unmanaged devices.

For IAM and NHI programmes, the identity angle is direct: personal accounts, OAuth grants, and unsanctioned SaaS usage can create access paths outside the approved identity fabric. For security teams, the harder challenge is that discovery has to combine endpoint, network, and authentication signals to expose what standard inventories miss.

Key questions

Q: What is the first step when shadow IT discovery is not yet in place?

A: Start with a managed-device baseline so you know which endpoints are enrolled, which operating systems are covered, and where unmanaged devices create blind spots. Without that baseline, discovery results are hard to interpret and remediation cannot be assigned to a real owner.

Q: Why does shadow IT create such a persistent data security and compliance problem for security teams?

A: Shadow IT increases risk because employees may move sensitive information into tools the security team cannot govern, monitor, or audit. That creates blind spots for access control, data leakage, and regulatory compliance. The issue is not only unsanctioned software. It is the loss of visibility and policy enforcement across devices, storage services, and communication channels.

Q: What are the signs that shadow IT controls are failing to catch risky user activity?

A: Common signs include repeated unauthorized logins, frequent use of unapproved applications, unusual file uploads or downloads, and a growing list of high risk users in event logs. If administrators cannot correlate timestamps, application details, and risk levels, the control is probably too weak to support timely intervention. Effective monitoring should make risky behavior visible before it becomes a breach.

Q: How should teams balance endpoint, network, and identity sources for discovery?

A: Use endpoint data as the primary view, then enrich it with network telemetry and identity-provider logs. Endpoint tools show what is installed and running, network controls show external service use, and identity logs reveal unexpected access paths that local inventory alone will miss.

Technical breakdown

Why single-source inventory fails for shadow IT

Shadow IT is difficult to discover because no single control plane sees every use case. Device agents can observe installed software and local process activity, but they miss unmanaged devices. Network sensors see SaaS and external traffic only when it crosses corporate infrastructure. Identity logs can reveal unexpected sign-ins and OAuth grants, but they do not capture all local software. A discovery programme therefore has to treat visibility as a correlation problem, not a product feature. The practical result is that inventory quality depends on overlap between data sources, not on any one source being complete.

Practical implication: Build discovery around correlated signals rather than trusting one inventory feed to define your software estate.

How MDM and osquery extend endpoint governance

MDM provides the baseline for managed-device visibility, including application lists, configuration state, and policy compliance. osquery goes further by treating the endpoint as a queryable dataset, which lets teams inspect installed applications, browser extensions, running processes, and outbound connections across macOS, Windows, and Linux. That matters because many shadow tools are not traditional installed applications. Portable utilities, user-installed extensions, and ad hoc scripts often sit outside standard management reports. A recurring query model turns discovery into a continuous control instead of a one-time audit project.

Practical implication: Use MDM for baseline governance and osquery for deeper recurring checks on software, extensions, and active connections.

Why SaaS, OAuth, and personal accounts change the risk profile

Shadow IT is not limited to software installed on a device. Personal cloud storage, AI tools, and SaaS accounts created outside IT control can move data and authority beyond the approved identity boundary. When employees authenticate with personal accounts or grant unexpected OAuth access, the organisation may lose visibility into retention, sharing, and downstream access. That creates both governance and NHI concerns because unmanaged tokens and third-party app permissions can persist after the user thinks a tool is no longer in use. Discovery therefore has to include identity-provider logs, not just endpoint data.

Practical implication: Include authentication and OAuth telemetry in discovery so unsanctioned SaaS usage and account-level access do not remain invisible.

Threat narrative

Attacker objective: The underlying objective is to move data and access outside governed controls while remaining invisible to standard inventory and review processes.

1. Entry occurs when employees adopt unapproved SaaS tools, browser extensions, or personal cloud services to bypass friction in approved workflows.
2. Credential or access abuse follows when personal accounts, OAuth grants, or unmanaged tokens connect those tools to corporate data.
3. Impact appears as lost visibility into data movement, patch status, and incident scope, which slows response and increases compliance exposure.

Breaches seen in the wild

• iOS apps leaking hard-coded secrets: Cybernews found 71% of 156,080 iOS apps leak hard-coded secrets, with open cloud storage and Firebase databases exposing user data.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Shadow IT discovery is really a control-correlation problem: organisations fail when they treat endpoint inventory, identity logs, and network telemetry as separate truths. Fleet's guide shows that the discovery gap is not absence of data, but absence of a joined view that can explain ownership, access, and data movement together. The practical conclusion is that governance has to start with correlation across sources, not with a single inventory dashboard.

Identity is part of shadow IT governance, not a downstream add-on: personal accounts, OAuth grants, and unsanctioned SaaS usage create access paths that traditional endpoint tooling cannot see on their own. That makes shadow IT a genuine IAM and NHI governance issue whenever tokens, delegated access, or third-party apps sit outside approved lifecycle controls. Practitioners should treat unexpected authentication events as discovery signals, not only as identity anomalies.

Untracked software becomes an operational risk long before it becomes an incident: patching, logging, and auditability all depend on knowing what exists. Once software escapes the approved estate, vulnerability management and incident response both lose precision. The named concept here is visibility debt: the longer discovery is deferred, the more expensive every other control becomes to operate. Teams should reduce that debt before they try to optimise anything else.

Distributed workforces expose the limits of perimeter-era discovery: when devices connect directly to SaaS from home networks, network-only approaches miss too much. That means modern shadow IT programmes need endpoint-based visibility, identity telemetry, and governance rules that assume off-network use is normal. The field implication is clear: discovery is now a continuous posture capability, not a quarterly audit activity.

Compliance only improves when discovery can be reconciled back to ownership: auditors do not just want a list of apps, they want evidence that in-scope software is known, owned, and controlled. This is why the combination of device inventory, SaaS logs, and approval workflows matters more than any single dataset. Practitioners should use discovery to close ownership gaps, not just to produce longer inventories.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: Top 10 NHI Issues

What this signals

Visibility debt: the longer organisations leave shadow IT undiscovered, the more controls have to work blind. Patching, incident response, and audit reconciliation all depend on a defensible baseline of what exists, who uses it, and whether it is approved.

Discovery should now be treated as an identity-adjacent governance function as much as an endpoint task. When personal accounts, OAuth grants, or unsanctioned SaaS appear, the issue is not only software sprawl but access outside the approved lifecycle.

A useful benchmark is how many service accounts or unmanaged assets the team can actually see. Only 5.7% of organisations have full visibility into their service accounts according to the Ultimate Guide to NHIs, which is a reminder that hidden estates are common.

For practitioners

• Establish a managed-device baseline Confirm which endpoints are enrolled, which operating systems are covered, and where unmanaged or BYOD devices create blind spots before expanding discovery.
• Correlate endpoint and identity telemetry Join installed software data with sign-in logs, OAuth grants, and SaaS admin events so unsanctioned tools are visible even when they are not installed locally.
• Query for browser extensions and active processes Use recurring osquery checks to look beyond standard application inventories and surface extensions, running processes, and external connections that indicate shadow usage.
• Classify findings by data and access risk Separate harmless convenience tools from tools that move sensitive data, create unmanaged authentication paths, or sit outside approved retention and logging controls.
• Feed discovery results into remediation workflows Map unapproved software to ticketing, removal, approved-substitute guidance, or policy enforcement so the discovery programme changes behaviour instead of producing reports only.

Key takeaways

• Shadow IT becomes a governance problem when organisations cannot see installed software, SaaS usage, and authentication paths together.
• Discovery fails most often when teams rely on one source of truth instead of correlating endpoint, network, and identity signals.
• The practical payoff is not just inventory, but better patching, faster incident response, and cleaner audit evidence.

Key terms

• Shadow IT Discovery: Shadow IT Discovery is the process of finding unauthorised applications, cloud services and devices used outside approved IT controls. It helps security teams identify unsanctioned data flows, exposed credentials and unmanaged access paths, then decide whether to block, monitor or bring each service under policy and identity control.
• Device Inventory: Device inventory is an authoritative list of endpoints, servers, mobiles and other managed assets, together with key attributes such as owner, location and software state. Without it, attackers can hide unmanaged systems, and defenders cannot prove coverage or patch gaps. Keep it current through discovery, enrolment and reconciliation against active network activity.
• OAuth Grant: An OAuth grant is the delegated permission an application receives to act on a user's behalf without storing the user's password. In NHI governance, it should be treated as a standing identity relationship with scope, ownership, and revocation requirements, not as a one-time setup detail.
• Visibility Debt: Visibility debt is the accumulated gap between what an organisation thinks it can see and what it can actually govern. In identity and data security, it grows when cloud resources, non-human identities, and data locations outpace discovery, making remediation slower and less accurate.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and identity lifecycle management. It is a useful fit for practitioners who need to connect discovery findings to access control and lifecycle decisions.