Uncovering Shadow IT: When Employees Bring Their Own Tools

TL;DR

Studies show that average organizations use three to five times more cloud services than IT is aware of.
Shadow IT doesn't arise from malice but because official processes are too slow, official tools are inadequate, or procurement channels are too cumbersome.
Technical discovery methods (network analysis, CASB, SSO logs, financial data) uncover the majority of shadow IT. But employee surveys provide the context.
Not all shadow IT is bad. Some tools solve real problems and can be officially adopted after a security assessment.
The goal is not zero tolerance but a process that provisions new tools quickly and securely, making the detour through shadow IT unnecessary.

What shadow IT is and why it happens

Shadow IT refers to the use of IT systems, software, cloud services, or hardware by employees without the IT department's knowledge or approval. This ranges from the marketing department that independently subscribed to a project management tool, to the sales team that stores customer data in a personal Dropbox, to the developer who spun up a cloud server for testing.

Shadow IT is not a new phenomenon, but the cloud has massively amplified it. In the past, you needed the IT department to install software or provision a server. Today, any employee with a credit card and an email address can activate a cloud service in two minutes. The entry barrier is practically zero.

Why employees turn to shadow IT

The reasons are almost never malicious. In the vast majority of cases, employees are trying to do their work better or faster:

The official tools are insufficient. The project management tool provided by the company is outdated, cumbersome, or lacks needed functionality. So the team uses Trello, Notion, or Asana on their own.

The procurement process is too slow. An employee needs a tool for a project starting in two weeks. The official procurement process takes six weeks. So the SaaS solution is paid for with a personal credit card and expensed.

Lack of awareness. Many employees see no security concerns in using a cloud service. "It's just a to-do list" or "There's no sensitive data in there" are typical assessments that are often wrong.

Convenience and habit. The employee used the tool at their previous job and wants to keep using it. Or they use the personal version of a tool they also use professionally (e.g., personal Google Drive instead of the company file share).

Departmental budgets. In some organizations, departments have their own IT budgets and procure software without coordinating with central IT.

Why shadow IT is a risk

Data protection and compliance

When employees upload business data to unapproved cloud services, you lose control over where that data is stored, who has access, and whether the processing is DSGVO (GDPR)-compliant. Without a data processing agreement with the provider, using the service for personal data violates GDPR.

A concrete example: The HR department uses an unapproved survey platform to conduct an employee satisfaction survey. The platform stores data on servers in the US, there's no data processing agreement, and the responses contain health-related information. This is a GDPR violation that can result in fines.

Security gaps

Unapproved tools don't undergo a security assessment. You don't know whether the provider has adequate security measures, whether data is encrypted, whether authentication is secure, or whether the service has known vulnerabilities. Every unassessed cloud service is a potential entry point. A systematic supplier evaluation is therefore essential for SaaS services as well.

Especially critical are tools that interact with the corporate network or other systems. An unapproved integration tool that synchronizes data between the CRM and a cloud platform could, if the cloud service is compromised, provide direct access to the CRM.

Data loss and data silos

When an employee leaves the company and their work products reside in a personal cloud account, that data is lost. Without access to the account, there's no way to recover the data. And even if the employee cooperates, the transfer back is cumbersome and error-prone.

Then there's the silo problem: information stored in shadow IT tools is invisible to the rest of the organization. There's no search, no backup, no versioning, and no integration with official systems.

License and cost risks

Unapproved software can cause licensing issues. If employees use pirated copies (which is also possible with SaaS through license circumvention), the company is liable. And even with legitimate use, uncontrolled costs arise: multiple departments subscribe to the same tool at different tiers without knowing about each other.

Uncovering shadow IT: The methods

Method 1: Network analysis

The most direct technical method: analyze outbound network traffic to identify cloud services employees are using.

DNS logs: Every access to a cloud service generates a DNS query. Analyzing DNS logs shows which domains are being accessed. Filter for known SaaS domains (trello.com, notion.so, dropbox.com, slack.com, etc.) and identify services that aren't officially approved.

Proxy/firewall logs: If web traffic passes through a proxy or next-generation firewall, you can filter traffic by application and category. Modern firewalls automatically categorize web traffic and can identify cloud storage, collaboration tools, and other SaaS services.

Network traffic analysis: Tools that analyze network traffic and identify cloud applications based on traffic patterns — even when encrypted via HTTPS (using SNI headers and IP addresses).

Method 2: Cloud Access Security Broker (CASB)

A CASB is a specialized security tool that sits between users and cloud services and provides visibility, control, and compliance for cloud usage. CASBs can:

Identify all cloud services in use (shadow IT discovery)
Monitor data traffic to and from cloud services
Enforce security policies (e.g., block upload of confidential data)
Provide risk assessments for cloud services

CASBs are the most powerful tool for shadow IT discovery, but also the most expensive. For SMEs, the investment pays off above a certain size and cloud usage intensity.

Method 3: SSO and identity provider logs

If your organization uses an identity provider (IdP) such as Azure AD, Okta, or Google Workspace, check the sign-in logs. There you'll see which applications have requested OAuth tokens or which SAML integrations exist. Many cloud services offer "Sign in with Microsoft" or "Sign in with Google," and each such sign-in leaves a trace in the IdP.

Also check the consented enterprise applications in Azure AD or Google Workspace. Employees can grant cloud services permissions to access emails, contacts, or files — often without understanding what permissions they're granting.

Method 4: Analyze financial data

Unapproved SaaS subscriptions are paid for — either via company credit cards, expense reports, or departmental budgets. Analyzing financial data can uncover shadow IT:

Search credit card statements for recurring payments to SaaS providers
Check expense reports for software and cloud service expenditures
Ask accounting about payments to vendors not in the official software inventory

Method 5: Employee surveys

The human method: ask employees directly what tools they use. This works best in an atmosphere that doesn't create fear of consequences. If employees worry about being punished for using unapproved tools, they won't admit to anything.

Frame the survey positively: "We want to understand which tools help you do your work so we can provide the right solutions." Use anonymous surveys or informal conversations within departments.

Employee surveys deliver something that technical methods cannot: context. Why was the tool adopted? What problem does it solve? What are the official tools missing?

Assessing and classifying shadow IT

Risk assessment for discovered services

Once you have a list of unapproved services, assess each service using the following criteria:

Data classification: What data is being processed or stored in the service? Personal data? Trade secrets? Financial information? Public information?

Provider security level: Does the provider have an ISO 27001 certification? Where is data stored? Is transmission encrypted? Is there MFA? What's the authorization model?

Compliance: Is there a data processing agreement? Is data processing GDPR-compliant? Is data stored in the EU/EEA, or are there adequate safeguards for third-country transfers?

Dependency: How many employees use the service? How business-critical is the data stored in it? What happens if the service is shut down tomorrow?

Alternatives: Is there an officially approved tool that serves the same purpose? If so, why isn't it being used?

Three categories for classification

Based on the assessment, assign each service to one of three categories:

Category 1: Legitimize. The service solves a real problem, has an acceptable security level, and can be officially adopted after formal review. Steps: complete security assessment, sign data processing agreement, add to the official software inventory, define usage guidelines.

Category 2: Replace. The service solves a real problem, but it has security or compliance deficiencies that aren't acceptable. Steps: provision an official alternative tool, migrate data, shut down the unapproved service. Important: provide the alternative before you shut down the service. Otherwise, you create a gap that will be filled by the next shadow IT.

Category 3: Shut down immediately. The service processes highly sensitive data without adequate protection, or it poses an acute security risk. Immediate shutdown with data backup where possible.

From uncovering to governing: The sustainable approach

Why uncovering alone isn't enough

Uncovering and shutting down shadow IT without addressing the root causes is like treating symptoms without a diagnosis. The shadow IT will come back — just with different tools. The sustainable approach is to eliminate the causes:

Introduce fast-track procurement

If the official procurement process takes six weeks, employees who need a tool tomorrow have to resort to shadow IT. Establish a fast-track process for low-risk cloud services:

Application via a simple form (name, purpose, data requirements)
Quick review by IT and the CISO (48 hours instead of six weeks)
Pre-approved catalog of permitted services from which employees can choose independently
Automatic provisioning via the identity provider

Build a self-service catalog

Create a catalog of vetted and approved cloud services that employees can activate independently. The catalog covers the most common needs: project management, communication, file sharing, surveys, whiteboarding, prototyping. For each service, there are clear usage terms and a security assessment.

Regular shadow IT reviews

Conduct quarterly or semi-annual shadow IT scans. Use the methods described above (network analysis, financial data, employee surveys) and compare results with the previous period. A trend toward less shadow IT indicates that your official offering better meets the needs.

Build awareness

Many employees don't realize that using unapproved cloud services poses a security risk. Integrate the topic into your awareness training:

What is shadow IT and why is it problematic?
What official alternatives are available?
How does the fast-track procurement process work?
Who do I contact if I need a tool that isn't in the catalog?

The tone should not be moralizing ("You must not") but solution-oriented ("Here's how you get the right tool the secure way").

Shadow IT in the ISMS

Relevant controls from ISO 27001

A.5.9 (Inventory of information and other associated assets): All systems and services in use must be inventoried — including cloud services.
A.5.23 (Information security for use of cloud services): Requirements for the security assessment and governance of cloud services.
A.8.1 (User endpoint devices): Control of software installed on endpoints.
A.5.19 (Information security in supplier relationships): Security requirements for service providers, including SaaS vendors.

Risk assessment

Shadow IT should appear as its own risk scenario in the ISMS risk assessment:

Risk "Use of unapproved cloud services": Likelihood high (because it occurs almost everywhere), impact dependent on the type of data affected (low for public data, high for personal or business-critical data).

The measures against this risk are those described in this article: technical discovery, assessment, legitimization or replacement, and the sustainable governance process. In ISMS Lite, every discovered cloud service can be recorded as an asset, given a risk assessment, and the legitimization or replacement process tracked as a measure. The tool costs 500 Euro pro Jahr for all modules, with no user limits.

Metrics

Track the following metrics to measure progress:

Number of discovered unapproved cloud services (trend over time)
Proportion of services that have been legitimized, replaced, or shut down
Average processing time for software procurement requests
Usage of the self-service catalog (number of activations)

The right attitude: Partner, not police

The most important success factor in shadow IT governance is the attitude of the IT department and the CISO (Information Security Officer). If you act as police, banning tools and punishing employees for creativity, you'll create resistance and push shadow IT further underground. If you act as a partner who understands needs and provides secure solutions, you create a climate where employees proactively approach IT before deploying a new tool.

The goal is not to prevent every unapproved usage. The goal is to have a process that provisions new tools quickly, securely, and simply — so that the detour through shadow IT becomes simply unnecessary. If you achieve that, you haven't just solved a shadow IT problem — you've fundamentally improved the collaboration between IT and business departments.