Topic starter
12/06/2026 1:24 am
TL;DR: Shadow IT in SaaS grows when employees adopt unsanctioned apps, stored credentials, and unvetted vendor access outside IT oversight, creating security, compliance, and data-loss exposure, according to Zluri. The governance gap is no longer whether people will bypass approved tools, but whether identity teams can still see, scope, and revoke the access they never approved.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “Shadow IT in the SaaS World - A Complete Guide”.
By the numbers:
- 80% of employees admit that they use apps that aren’t approved by IT.
- 57% of IT leaders are concerned about shadow IT.
Key questions
Q: How should security teams govern shadow IT in SaaS environments?
A: Security teams should govern shadow IT by treating it as unmanaged access, not just unsanctioned software.
Q: Why does shadow IT increase cyber risk even when employees are trying to improve productivity?
A: Shadow IT creates blind spots.
Q: What happens when SaaS applications are adopted without IT approval?
A: When SaaS is adopted without IT approval, the organisation accumulates shadow IT, which creates gaps in visibility, policy enforcement, and data protection.
Practitioner guidance
- Inventory unsanctioned SaaS usage Build a living list of employee-adopted apps, business-unit purchases, and connected tools that sit outside approved procurement and security review.
- Review credential storage paths Find where users keep SaaS credentials in browsers, spreadsheets, personal vaults, and shared notes, then remove those storage paths from the normal workflow.
- Tighten third-party sharing rights Check whether vendors and external collaborators have edit access when view access is sufficient, and align each shared account to a documented business owner.
Bottom line: Shadow IT in SaaS becomes a governance problem when access, ownership, and data handling move outside central IT control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 11:19 am
Shadow IT in SaaS is not just a tooling problem, it is an identity governance failure. When employees adopt applications outside IT approval, the organisation loses the ability to govern who owns access, who can revoke it, and where business data ultimately lives. That makes SaaS shadow IT a lifecycle issue as much as a discovery issue, and it belongs in IAM and IGA operating models, not only in procurement review.
A few things that frame the scale:
- The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.
A question worth separating out:
Q: What happens when organisations block unapproved SaaS apps without offering approved alternatives?
A: Blocking without an alternative often shifts the problem rather than solving it. Users look for workarounds, adopt unsanctioned tools, or delay work while trying to regain access. A better approach is to pair blocking with clear messaging, redirection to approved services, and role-based exceptions where justified. That preserves control while keeping work flowing.
👉 Read our full editorial: Shadow IT in SaaS is an identity governance problem
This post was modified 4 days ago by NHI Mgmt Group