Shadow IT is a visibility problem before it is a policy problem

At a glance

What this is: Shadow IT hides in SaaS, unmanaged devices, shared files and browser-based AI tools, and the article's core finding is that visibility gaps, not policy gaps, let it spread.

Why it matters: IAM, NHI and security teams need exposure-based discovery because unowned tools, unmanaged accounts and unsanctioned AI use can bypass offboarding, data controls and governance reviews.

By the numbers:

• The average organisation is actually running 106 SaaS applications.
• 59% of IT teams say they remain somewhat or very concerned about unsanctioned tools.

Context

Shadow IT becomes a governance problem when users adopt tools faster than approved processes can absorb them. In practice, the control gap is not a missing policy document, but a missing inventory of where software, files and AI services are actually being used across the business.

That gap matters to identity and access teams because unsanctioned services often create unmanaged accounts, orphaned data and access paths that never enter lifecycle controls. Once a tool sits outside inventory, offboarding, entitlement review and data classification all lose their starting point.

Key questions

Q: What breaks when shadow IT is only managed through inventory reviews?

A: Inventory reviews find tools, but they do not enforce behaviour. By the time a review is complete, data may already have been shared, copied, or retained outside approved systems. Effective shadow IT control needs continuous monitoring, policy enforcement, and a process for handling exceptions, not just periodic discovery.

Q: Why does shadow AI create more risk when organisations try to prohibit it?

A: Prohibition often shifts usage underground, which reduces visibility and weakens logging, data control, and accountability. Once employees move to hidden tools, the organisation loses the ability to see which identities are active or what information is being exposed. That makes the risk harder to detect and more expensive to remediate.

Q: What signals show that Shadow IT is becoming a governance problem?

A: Look for overlapping SaaS subscriptions, personal accounts used for work, OAuth grants to external apps, and licences left unused after 30 days. These are signs that ownership is unclear and lifecycle controls are failing. If you cannot explain why an app exists or who owns access, the problem is already governance-related.

Q: How do organisations balance employee productivity with governance when they discover shadow IT?

A: Organisations should treat shadow IT as a governance and enablement problem, not just a blocking exercise. The practical response is to assess business need, security risk, and data exposure, then either sanction, restrict, or retire the app. This approach preserves productivity while reducing unmanaged access and giving IT a consistent framework for decision making.

Technical breakdown

Why discovery fails when adoption happens faster than inventory

Shadow IT discovery breaks when the organisation treats inventory as a periodic review instead of a live control. SaaS sign-ups, browser-based tools and unmanaged file sharing all happen outside traditional procurement workflows, so the system of record lags the system of use. The result is a control blind spot: security teams can enforce policy on approved tools, but they cannot govern what they cannot enumerate. In identity terms, that means accounts, files and workflows exist outside the authoritative lifecycle, so ownership and revocation become guesswork.

Practical implication: move discovery closer to endpoint and cloud activity so inventory updates as adoption happens, not after an audit cycle.

Why browser-based AI tools create data exposure without leaving a trail

Generative AI in the browser is an example of Shadow AI: an unsanctioned service used in-line with work but outside formal oversight. Because it often requires no install, no procurement ticket and no delegated account, it bypasses the normal signals that security tools use to detect new applications. The hidden risk is not just use of an unapproved service, but the movement of drafts, contracts, support transcripts or code into a system the organisation may not control. That creates a governance problem for both data security and identity, because the user remains authenticated while the data path becomes invisible.

Practical implication: classify browser AI activity by data sensitivity before you decide whether it is an acceptable or blocked workflow.

How unmanaged files and personal accounts break offboarding

When employees move business data to personal cloud storage or unsanctioned file-sharing services, the file leaves the tenant and the organisation loses the normal lifecycle hooks around it. The same issue appears when the account belongs to the individual rather than the company, because offboarding no longer guarantees revocation or data retrieval. This is where Shadow IT turns into identity governance debt: the organisation may know a person left, but it does not know what shadow accounts, shared files or external collaboration links remain live. The control failure is not just unauthorised software, but ownership failure.

Practical implication: tie offboarding to data-location checks so departing users cannot leave sensitive files behind in personal or unowned accounts.

Threat narrative

Attacker objective: The practical objective is not always external intrusion, but uncontrolled access to sensitive business data outside approved governance and recovery processes.

1. Entry occurs when a user adopts an unsanctioned SaaS service, browser AI tool or personal file-sharing account to meet a deadline faster than the approved stack allows.
2. Credential or access sprawl follows when the user creates an account with a work email, invites others or uploads company files without the account entering inventory.
3. Impact emerges when sensitive data sits in a tool or account the organisation cannot review, revoke or classify, leaving exposure undiscovered until after the fact.

Breaches seen in the wild

• SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Shadow IT is a visibility failure before it is a policy failure. The article correctly shows that people usually adopt unsanctioned tools to solve workflow friction, not to evade governance. That means the first control question is whether the organisation can see what is being used, where data is moving and who owns the account. Security programmes that start with prohibition instead of discovery are solving the wrong problem.

Shadow AI now turns browser activity into an identity and data governance issue. A user pasting contracts, transcripts or source code into a generative AI service is not just using a different app. They are moving sensitive content into a system that may retain, reuse or expose it outside the organisation's normal control plane. The named concept here is exposure-based control: govern the tools that touch classified data, not every unfamiliar tool equally.

Offboarding is incomplete when the organisation never knew the account existed. The article's file-sharing examples show a common governance assumption breaking down, namely that revocation can only happen for known assets. Shadow IT creates orphaned data and unowned access paths, which means identity lifecycle controls must extend to shadow accounts, shared links and external collaboration surfaces.

Browser extensions are an under-governed privilege layer. They sit inside the session where sensitive files already live and often request broad read-and-write permissions. That makes them materially different from casual web usage, because the extension inherits browser trust and can reach content that conventional application inventories never classify. Practitioners should treat extension governance as part of access control, not just endpoint hygiene.

Exposure scoring is the right governance model for distributed adoption. The article's central operational insight is that not every unsanctioned tool deserves the same response. Mature programmes will rank tools by the sensitivity of the data they touch, the ownership of the account and the reversibility of the exposure. That is the only sustainable way to preserve agility without losing control.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: Top 10 NHI Issues

What this signals

Exposure-based governance is the only scalable response to Shadow IT. Small teams cannot keep pace with adoption if they rely on manual approval gates and periodic inventories. The better model is to measure what data a tool touches, then decide whether the exposure justifies control.

Shadow AI extends the same problem into a faster-moving channel, where browser use can create unmanaged data flow without a traditional install or ticket. That makes classified-data visibility the first practical control, not the last.

The operational pattern is clear: if departments independently find the same unsanctioned service useful, the issue may be a missing capability in the approved stack rather than a discipline problem. That is where governance should adapt instead of only enforcing.

For practitioners

• Implement live SaaS discovery Continuously catalog web applications, devices and software in use so the inventory reflects real adoption instead of periodic assumptions.
• Classify data before scoring tools Identify which files, records and workflows are sensitive or regulated before deciding whether an unsanctioned service is risky.
• Separate personal from business use Filter harmless personal activity out of review queues so privacy is preserved while exposure decisions stay focused on business data.
• Prioritise the short list of high-exposure tools Apply policy to the few applications that actually touch classified data, then leave low-risk adoption in place until the risk picture changes.
• Close offboarding gaps around shadow accounts Check for personal storage, shared files and external collaboration links before finalising user offboarding so data does not remain behind in accounts no one owns.

Key takeaways

• Shadow IT becomes dangerous when organisations cannot see which tools, files and accounts users adopted outside the approved stack.
• The article frames shadow AI, unmanaged devices and personal file sharing as governance gaps that create orphaned data and access.
• The most effective response is exposure-based control, with discovery and data classification preceding any restriction decision.

Key terms

• Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Exposure-Based Control: Exposure-based control is a governance approach that prioritises tools and accounts according to the data they touch and the access they hold. It is more practical than blanket bans because it focuses remediation on services with real sensitivity, real ownership gaps, and real downstream risk.
• Inventory blind spot: An inventory blind spot is a gap between the tools the organisation believes are in use and the tools employees are actually using. In security terms, it prevents classification, ownership assignment, offboarding and policy enforcement from starting at the right place.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps security practitioners connect identity lifecycle controls to the broader risks created by unmanaged access and shadow adoption.