Topic starter
18/08/2026 2:37 pm
TL;DR: Unauthorized software on Windows endpoints persists when inventory, policy and response are not tied together, according to Wazuh. Endpoint governance has to turn discovery into removal, or drift stays in place.
Editorial analysis by NHI Mgmt Group, based on content published by Wazuh: “Managing shadow IT with Wazuh”.
Key questions
Q: Why do unapproved apps create more governance risk than teams expect?
A: Unapproved apps matter because they create an access path outside the normal approval and review process, so policy cannot be enforced at the same speed as adoption.
Q: How do organisations know whether shadow IT controls are actually working?
A: They should look for shrinking gaps between discovered apps and remediated access, not just a larger inventory.
Q: What breaks when Shadow IT apps are not in the identity inventory?
A: Identity governance breaks first, because you cannot sanction, classify, or revoke access for applications you do not know exist.
Practitioner guidance
- Implement continuous software inventory on Windows endpoints Use endpoint inventory telemetry to track installed packages, services, users and processes so unauthorized software is visible before it becomes a policy exception.
- Define an allowlist for sanctioned endpoint software Maintain a policy-backed list of approved applications, including remote access tools and AI tools, and trigger alerts when installations fall outside it.
- Test automated uninstallation by installer type Validate removal logic for MSI, NSIS, Inno Setup, portable apps and Microsoft Store packages so remediation succeeds on the software you actually find.
Bottom line: Shadow IT on Windows endpoints is primarily a visibility and policy-enforcement problem, not just a question of unwanted software.
Glossary terms: Shadow IT, Endpoint Inventory, Active Response, Software Allowlisting
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
18/08/2026 3:22 pm
Shadow IT is really an inventory failure before it becomes an access problem. The article is about unauthorized software on Windows endpoints, but the deeper control issue is that security teams cannot govern what they cannot continuously see. That makes endpoint inventory a first-order governance input, not a housekeeping function. Practitioners should treat software discovery coverage as part of access control assurance.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between detecting Shadow IT and remediating it?
A: Detection tells you that an unauthorized application exists on a device. Remediation changes the device state by removing or containing that application. Good programmes need both, because detection without enforcement only documents drift, while remediation without reliable detection risks removing the wrong software or missing the real exception.
👉 Read our full editorial: Shadow IT detection and automated removal on Windows endpoints