Topic starter
24/10/2026 8:50 pm
TL;DR: Shadow IT persists because most identity systems authenticate users before they verify the device, so detection tools document unauthorized access after identity has already been issued, according to Smallstep. The real control gap is admission, not visibility: device proof has to be mandatory before access is granted.
Editorial analysis by NHI Mgmt Group, based on content published by Smallstep: “Shadow IT Exists Because You Don't Control Which Devices Get Identity”.
Key questions
Q: What fails when shadow IT controls rely on detection instead of admission?
A: Detection-based controls can show that an unauthorized device or application connected, but they do not stop the access from being issued in the first place.
Q: Why do unmanaged devices complicate zero trust access decisions?
A: Because zero trust depends on continuous verification, and unmanaged devices weaken the confidence you can place in the session context.
Q: What are the signs that device validation is happening too late?
A: Look for access that is granted on valid user credentials even when the device is not enrolled, not compliant, or only conditionally checked after login.
Practitioner guidance
- Define device proof as a precondition for identity issuance Require device identity checks before tokens are minted, not after sessions begin.
- Separate admission control from continuous monitoring Use monitoring to detect drift, but do not let it substitute for the initial trust decision.
- Extend governance to workloads and SaaS access Apply the same admission rules to workload identities, API tokens, and OAuth grants so unmanaged services cannot authenticate merely because they hold valid credentials.
Bottom line: Shadow IT persists because access is often granted before the organisation confirms that the device, workload, or application should be trusted.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →