Shadow IT: Finding What Procurement Never Approved

Shadow IT is rarely a rebellion. A team needs something done, the approved tool is slow or missing, and a free account takes five minutes. Multiply that across a company and you get dozens of tools holding company data that nobody in security or procurement has ever seen.

The instinct is to ban it. That usually fails, because the need that created the tool is still there. A better response treats discovery as a business question: what are people using, what is it for, and which of these should we make official?

This guide sets out a five-step workflow: find, classify, decide, migrate, then keep checking.

Key takeaways

• Shadow IT usually signals an unmet need, not bad intent.

• You cannot manage what you cannot see, so discovery comes first.

• Classify by the data involved and the risk, not by the tool's popularity.

• Every discovered tool gets one of three decisions: legitimize, replace or block.

• Plan the migration, or the tool will simply reappear.

Step 1: Find what is actually in use

Start with sources you already have: expense reports and card statements, single sign-on logs, browser and network logs, and email domains. Add a plain, non-punitive survey asking teams what they use to get work done.

The survey often finds more than the logs. Make it safe to answer honestly, or people will not. A control that asks for an inventory of software is a long-standing basic: the CIS Control on software asset inventory calls for managing all software so that unauthorized and unmanaged software is found.

Step 2: Classify by the data and the risk

For each tool found, ask three questions. What company data does it hold? Who can access it? What happens if the vendor is breached or disappears?

A free design tool holding public marketing images is a small matter. A file-sharing account holding customer contracts is not. Rank by the data, not by how many people use it.

Step 3: Decide one of three ways

Each tool gets a decision. Legitimize: the tool is fine, so bring it under contract, sign-on and review. Replace: the need is real but a better-controlled tool exists, so move people to it. Block: the risk is too high and the need is covered elsewhere.

The table shows the shape of the decision log. The entries are illustrative.

Tool found (illustrative)	Data held	Decision	Owner	Next step
Free file-sharing account	Customer contracts	Replace	IT lead	Move files to approved storage in 30 days
Team project board	Internal task lists	Legitimize	Operations	Add to sign-on and vendor review
Unreviewed browser add-on	Page contents	Block	Security	Remove through device management

Step 4: Migrate people, not just rules

A block with no alternative creates a new shadow tool within a month. When you replace or block something, give people the approved path and help them use it.

Set a date, move the data, close the old account and confirm it is gone. The same discipline applies to AI tools, which spread the same way; the post on the shadow AI threat explains why saying no alone does not work.

Step 5: Keep discovery running

Treat this as a recurring check, not a one-time project. Repeat the log review each quarter and keep the survey short and simple.

Track two numbers for leadership: the number of unapproved tools found, and the share that reached a decision. Falling counts and fast decisions mean the process is working.

Frequently asked questions

Should we ban shadow IT?

A blanket ban rarely works, because the need that created the tool remains. Discover, classify and decide tool by tool, and give people an approved alternative where you block.

How do we find shadow IT without surveillance concerns?

Use existing business records such as expenses and sign-on logs, and add an open survey. Be clear that the purpose is to meet needs and manage risk, not to punish people.

What is the biggest risk from shadow IT?

Company data held in accounts nobody manages. If the vendor is breached, the employee leaves or the account lapses, the company may not even know the data was there.

Who owns the process?

IT or security runs discovery and classification, while business leaders own the decision about which needs deserve an approved tool.

A Defensible Next Step

Pull last quarter's expense report and search for software subscriptions nobody in IT recognizes. That single list is usually enough to start the workflow. Book a Decision-Clarity Call if you would like help running it.