Shadow IT guide
For IT and SaaS managers: services people use for company work that never went through IT.
Free guide · pairs with the calculatorShort answer
Shadow IT is software, SaaS, or cloud services used for work without IT's approval or knowledge.
A personal file share, an unsanctioned SaaS or AI tool, and a free trial on a company card are the usual forms. A product IT has approved is not shadow IT. Malware planted by an attacker is not shadow IT either. Unused seats on a product you already own are a separate problem: that is seat waste, and it is what the calculator prices.
The line
The test is approval and knowledge, not whether the tool is useful. A service IT has heard of, and has not accepted, is still shadow IT. A service in daily use that never reached IT is too. Either gap is enough.
People adopt these tools because they can start the same day. The approved path is slow, the approved product does not fit the job, or a teammate already sent a link. The person doing this is someone the company already trusts to do the work. That is why the tool is easy to miss, and why blocking it without a replacement moves the files somewhere harder to see.
This guide stays on software, SaaS, and cloud services: the things that create accounts, hold files, and add seats. Personal laptops and phones are a related visibility problem, and they are not the subject here.
Common examples
These are patterns, not a vendor blacklist. A product your company has already approved is not shadow IT. The same kind of product, adopted on the side, is.
Someone sends a customer file, a recording, or a working folder through a personal cloud drive or a personal file-transfer account because the approved tool was too slow, too small, or too locked down. The copy now lives in an account IT cannot offboard, and it stays there after the person leaves.
A team starts a project app, a design tool, or an AI assistant on its own. Sign-up takes a minute. Work product, prompts, and customer context go to a vendor IT has not reviewed, often under a work email that was never added to single sign-on. The tool can be a good fit. It is still unapproved.
Someone starts a trial, attaches a company card so it does not lapse, and the plan converts. Finance sees a software charge. IT never signed a contract, never named an owner, and never set a seat count. Those seats remain after the person who started the trial changes roles or leaves.
Risks
The risk is not that the app exists. The risk is company data and company money sitting where nobody in IT can see them, close them, or explain them.
The vendor was never reviewed. Access may be a personal password rather than your identity provider, so you cannot require your own MFA or remove the account on the person's last day. Files and prompts stay in that account after they leave. A phished password is outside the controls you set on approved tools.
Contracts and data-processing terms cover vendors you approved. They do not cover a tool someone started on a Tuesday. If the contents are customer, employee, health, or financial data, you may not be able to say where it is stored, who can open it, or how long it is kept.
You can pay for the approved product and, after a trial converts, for the substitute. Seats on the approved product stay assigned to people who moved the work. Seats on the shadow product have no IT owner, so they survive role changes and departures. A free tool skips the invoice and still carries the first two risks.
Discovery
You do not need a new product to start. Four sources catch different slices. Read them together. A name that shows up in one list and not the others is the finding.
| Source | What it can show | What it misses |
|---|---|---|
| SSO and identity-provider logs | Apps people sign in to with the company identity, including OAuth grants to third-party apps IT never assigned. | Anything used only with a personal login. |
| Expense and card reports | Recurring software charges and trials that converted on a company card. | Free tools, and anything paid on a personal card. |
| Browser, network, or CASB data | Cloud apps observed by a managed browser, proxy, gateway, or cloud access security broker. | Work that never crosses a managed device or network. |
| Surveys | Tools people will name when asked, including personal accounts the logs never see. | Tools people still will not mention. |
In the identity provider, look past the apps you assigned. User consent and OAuth grants show third-party apps someone connected with a work account. A tool used only with a personal login will not be on that list, which is why the card report and the survey exist.
An app on a company card and missing from SSO is a paid tool IT does not control. A tool named only in a survey is usually a personal account. A destination in browser, network, or CASB data that IT did not deploy is a candidate: confirm the team uses it for work before you treat it as shadow IT. Ask what people use to share files, run projects, and try AI, and say you are closing gaps in the approved stack rather than collecting names for a ban. Otherwise the survey misses the same tools the logs miss.
Management
A blanket ban is a visibility decision. Block the domain, and the same files move to a personal account on a network you do not monitor. Inventory first, then decide tool by tool.
Make the approved path faster than a trial. Shadow IT grows where asking for a tool takes longer than starting one. A short intake — what the tool is, what data it will hold, and who owns it — is the practical control.
Where the shadow tool duplicates a product you already pay for, keep one. If you keep the approved product, move the work back and cancel the extra subscription, then see who never returned to those seats. If the shadow tool is the one people use, sanction that one and cut the idle seats on the old contract.
Check again on a schedule. New trials and new AI tools show up between audits. SSO grants, card reports, and a short survey catch the next wave. One cleanup does not stay current.
Seat waste
Shadow IT and seat waste are the same missing inventory, seen from two sides. The unapproved tool holds the work and, once a trial converts, its own seats. The approved tool holds licenses for people who left. Neither list gets cleaned up, because each one is invisible to the team that owns the other.
When you find a shadow app, ask two seat questions. Who still has a license for the approved product they stopped using? And who is paying for seats on the tool you just discovered, including people who have since left? Both counts are waste. A free shadow tool adds no seat invoice. It can still explain why an approved product looks underused.
SeatLeak does not discover shadow IT, and it does not connect to vendors. After you have the counts, the seat waste calculator estimates unused-license cost from licensed seats, active use, and monthly cost per seat. The math runs in the browser. Nothing is uploaded or stored.
Free tool
The guide above is how you find unapproved tools and the licenses they leave behind. The calculator turns a seat count into a waste range and a renewal target. Enter licensed seats, cost per seat, and how many people still use the product.
Open the seat waste calculatorCommon questions
Shadow IT is software, SaaS, or cloud services used for work without IT's approval or knowledge. It is a tool a person or team adopts on their own. It is not malware, and it is not a product IT has already approved.
Common examples are personal file sharing for work documents, unsanctioned SaaS or AI tools a team adopts on its own, and free trials started on a company card. A product IT has approved is not shadow IT.
The risks are security and data exposure, compliance gaps, and duplicate spend. Company data can sit with an unreviewed vendor in an account IT cannot close. Regulated data can move with no contract or data terms. The company can pay for an approved product and a substitute at the same time, including seats nobody still uses.
Compare SSO and identity-provider logs, including OAuth app grants, with expense and card reports, browser, network, or cloud access security broker (CASB) data, and a short survey of the teams doing the work. Each source misses tools the others can see.
Inventory the tools first. Sanction the ones people depend on when the risk is acceptable, limit low-risk use with clear data rules, and stop only what you cannot accept, with an approved replacement. A blanket ban pushes the same work into personal accounts that are harder to see.
When work moves to an unapproved tool, seats on the approved product can stay assigned and unused. A trial on a company card can also turn into a paid subscription whose seats IT does not own. Compare licensed seats with active users on each product you pay for. The SeatLeak calculator estimates that unused-license cost from the numbers you enter.