Topic starter
12/06/2026 12:50 am
TL;DR: SaaS adoption is creating a shadow IT problem that traditional surveys, SSO, CASB, ITAM, and SAM tools only partially expose, while Zluri argues that nine discovery methods are needed to map usage across the enterprise, according to Zluri. Shadow IT is now an identity governance and access visibility issue, not just an application inventory problem.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “How to Eliminate Shadow IT”.
By the numbers:
- 97% of cloud apps used in the enterprise are shadow IT, unmanaged, and often freely adopted, according to Netspoke research cited by Zluri.
Key questions
Q: How should IAM teams discover SaaS apps that are not tied to SSO?
A: Use multiple evidence sources, including finance data, direct app integrations, directories, and endpoint or browser signals, rather than relying on SSO alone.
Q: Why do ITAM and SAM miss shadow IT in SaaS environments?
A: They miss it because they were built around hardware and on-premise software, not browser-delivered subscriptions created outside traditional procurement flows.
Q: What breaks when SaaS discovery is not connected to governance workflows?
A: Discovery becomes reporting instead of control.
Practitioner guidance
- Build a multi-signal SaaS inventory Combine identity provider logs, finance and expense records, direct app integrations, and directory data so no single source defines the application estate.
- Reconcile shadow apps into governance workflows Route discovered SaaS into access review, application ownership assignment, and dormant app cleanup so discovery leads to action, not just reporting.
- Separate sanctioned from self-adopted SaaS Tag applications by procurement path, identity source, and business owner so unsanctioned adoption is visible during certification and offboarding.
Bottom line: SaaS shadow IT is fundamentally a governance visibility problem because users can adopt cloud apps faster than traditional inventory processes can track them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 10:20 am
SaaS shadow IT is now an identity governance problem disguised as discovery. The article is about more than missing app inventory. Once users can self-adopt SaaS outside central procurement, the programme loses sight of who created the access path, who approved it, and who is accountable for offboarding it. That turns discovery into an identity control issue, not just an IT asset-management issue.
A question worth separating out:
Q: When should security teams treat an app as shadow IT rather than an approved tool?
A: Treat an app as shadow IT when it exists outside the governed acquisition, approval, or identity lifecycle, even if users adopted it for legitimate work. The key signal is not whether the tool is popular, but whether IT can verify ownership, access paths, and lifecycle control.
👉 Read our full editorial: Shadow IT in SaaS discovery is still outpacing IAM controls
This post was modified 4 days ago by NHI Mgmt Group