Topic starter
28/08/2026 12:04 pm
TL;DR: Shadow IT now spans unsanctioned SaaS apps, unmanaged devices, shared files, and browser-based AI tools, with BetterCloud reporting an average of 106 SaaS applications per organisation and 59% of IT teams still concerned about unsanctioned services, according to Safetica and cited research. The governance lesson is straightforward: discovery, data classification, and exposure-based control matter more than blanket bans when users adopt tools faster than approved processes can absorb them.
Editorial analysis by NHI Mgmt Group, based on content published by Safetica: “Shadow IT: The 3 Places It Hides in Your Company”.
By the numbers:
- The average organisation is actually running 106 SaaS applications.
- 59% of IT teams say they remain somewhat or very concerned about unsanctioned tools.
Key questions
Q: What breaks when shadow IT is only managed through inventory reviews?
A: Inventory reviews find tools, but they do not enforce behaviour.
Q: Why does shadow AI create more risk when organisations try to prohibit it?
A: Prohibition often shifts usage underground, which reduces visibility and weakens logging, data control, and accountability.
Q: What signals show that Shadow IT is becoming a governance problem?
A: Look for overlapping SaaS subscriptions, personal accounts used for work, OAuth grants to external apps, and licences left unused after 30 days.
Practitioner guidance
- Implement live SaaS discovery Continuously catalog web applications, devices and software in use so the inventory reflects real adoption instead of periodic assumptions.
- Classify data before scoring tools Identify which files, records and workflows are sensitive or regulated before deciding whether an unsanctioned service is risky.
- Separate personal from business use Filter harmless personal activity out of review queues so privacy is preserved while exposure decisions stay focused on business data.
Bottom line: Shadow IT becomes dangerous when organisations cannot see which tools, files and accounts users adopted outside the approved stack.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 18 hours ago by NHI Mgmt Group
28/08/2026 12:04 pm
Shadow IT is a visibility failure before it is a policy failure. The article correctly shows that people usually adopt unsanctioned tools to solve workflow friction, not to evade governance. That means the first control question is whether the organisation can see what is being used, where data is moving and who owns the account. Security programmes that start with prohibition instead of discovery are solving the wrong problem.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do organisations balance employee productivity with governance when they discover shadow IT?
A: Organisations should treat shadow IT as a governance and enablement problem, not just a blocking exercise. The practical response is to assess business need, security risk, and data exposure, then either sanction, restrict, or retire the app. This approach preserves productivity while reducing unmanaged access and giving IT a consistent framework for decision making.
👉 Read our full editorial: Shadow IT is a visibility problem before it is a policy problem
This post was modified 18 hours ago by NHI Mgmt Group