Field notes · Definition · Survey date: September 2026
What Is Shadow IT?
1 min read
Bottom line
Shadow IT is technology used without the knowledge or approval of IT or security. The most common examples are SaaS apps that employees sign up for themselves, OAuth grants to third-party apps, browser extensions and personal or unmanaged devices.
Why is shadow IT a risk?
Because nobody is checking it. An unsanctioned SaaS app may hold company data with no single sign-on, no offboarding and no owner. An unmanaged device may reach internal systems with no EDR agent. Neither shows up in the tools security uses to apply controls.
How do you find shadow IT?
By combining signals that each see part of it: identity provider and SSO logs, OAuth grants, endpoint telemetry, expense and procurement data, and network discovery. Axonius, for example, documents discovery of sanctioned, unsanctioned and unmanaged SaaS, including shadow apps, OAuth tokens and risky extensions, from identity, SSO, endpoint and direct integration data. Network discovery tools such as runZero and Lansweeper find unmanaged devices.
Related terms
Tools that do this
Frequently asked questions
Is shadow IT always bad?
No. It often shows where approved tools fall short. The risk comes from not knowing it exists, so it cannot be governed.
Which tools detect shadow SaaS?
In our coverage grid, Axonius, JupiterOne and Oomnitza document SaaS app coverage.