Shadow IT

What is shadow IT?

Shadow IT is technology in use inside an organization that was not provisioned, recorded or approved through the standard process — cloud accounts, servers, SaaS applications, devices and services that exist and do work while appearing in none of the systems meant to track them.

Key takeaways

• Shadow assets are invisible by construction. Anything created outside the standard process has no inventory entry by definition, so a coverage percentage measured against that inventory cannot see it.
• Agent-based tooling cannot find them. An agent is deployed onto known assets. Discovery has to come from somewhere the asset touches without cooperating.
• It is usually competence, not defiance. Shadow IT appears where the sanctioned path is slower than the work requires. Treating it purely as a policy violation misdiagnoses it.
• Ownership is the useful output. Finding an unrecorded asset achieves little if nobody can be identified as accountable for it.
• Discovery is continuous. A one-off audit finds the shadow estate as it was that week.

Why it matters

The assets most likely to be unrecorded are frequently the ones that matter most: a proof-of-concept that became a production dependency, a cloud account opened for a project that outlived it, a server that was never decommissioned because nobody remembered it existed. They receive no patching cadence, no monitoring, no ownership review and no scanning, which means the normal controls do not degrade on them — they were never applied.

This also distorts every metric built on the inventory. Patch compliance of 98% is a statement about known assets, and the unknown remainder is not a rounding error but a systematically riskier population.

How unmanaged assets are actually found

• Cross-system gap analysis. An asset that appears in the cloud provider's API but not the CMDB, or in identity logs but not endpoint management, is visible by its absence from one side.
• Network observation. Devices that appear in DHCP, DNS or traffic records without a corresponding inventory entry.
• Identity and authentication records. Service accounts and SaaS applications reveal themselves through single sign-on and OAuth grants.
• Billing and procurement. Cloud spend and expensed subscriptions are an unromantic but effective source for SaaS specifically.
• Certificate and DNS records. Externally issued certificates and subdomains frequently expose infrastructure nobody internally has recorded.

A worked example of a gap analysis

The mechanism is easiest to see on a single cloud account. The provider's own API is authoritative about what exists inside it and returns, for the sake of the example, 412 running compute instances. The configuration management database, queried for the same account, holds 340 records. The endpoint management console reports agents checking in from 297 of them. Three numbers, three systems, and none of them wrong from its own point of view.

The differences are the finding. The 72 instances present in the provider API but absent from the CMDB were created outside the provisioning process — by an infrastructure-as-code pipeline nobody registered, or by an engineer with console access during an incident. The 43 present in the CMDB but with no agent are known assets that were never onboarded to management, which is a different problem with a different fix. A handful will be in the CMDB and not in the provider API at all, meaning the record outlived the machine.

None of this required deploying anything, because every input was already being produced for another purpose. It also shows why the output has to be a set of decisions rather than a single number: the three populations need different responses, and calling all 115 discrepancies shadow IT would misdescribe most of them.

Shadow IT, unmanaged assets and shadow AI

The terms overlap and are worth separating. Shadow IT is the broad category: anything running outside the sanctioned process. Unmanaged assets are the subset that specifically lack management tooling — no agent, no patch cadence, no monitoring — and they include assets IT knows about but never onboarded. Shadow AI is the current fast-growing instance of the same pattern, where model endpoints and agent integrations are adopted at team level well ahead of any governance.

The mechanics are identical in all three cases, which is the practical point: the discovery approach that finds an unrecorded server also finds an unrecorded model endpoint, because both are found through the traces they leave in systems that were not designed to track them.

What to do once they are found

A discovered asset needs a decision, not automatically a patch. Some should be decommissioned; some should be brought under management; some are legitimate and simply need recording and an owner. Attempting to remediate a shadow estate before triaging it generates a large volume of work against assets whose future is undecided.

The recurring version matters more than the first pass. Shadow IT regenerates as long as the conditions that produce it persist, so the discovery mechanism has to run continuously and the trend line is a more useful metric than the count.

How to evaluate a discovery approach

• Does it require cooperation from the asset? Anything that depends on an agent, a credential or a registration step will miss precisely the population it is meant to find.
• Does it reconcile sources rather than replace them? The signal is in the disagreement between systems. An approach that builds a new authoritative list adds a sixth source of truth to the five that already disagree.
• Does it run continuously? Discovery frequency should match provisioning frequency. In an estate where infrastructure is created by pipeline in minutes, a quarterly reconciliation describes history.
• Does it produce an accountable owner? An unattributed asset on a list is a task nobody has. Attribution derived from observable signals — deployment history, login records, tagging, ticket activity — is what makes the finding actionable.
• Does it distinguish the populations? Never-recorded, recorded-but-unmanaged and recorded-but-gone are three different remediations, and a tool that reports one aggregate number hides which is which.

FAQ

How is shadow IT different from an unmanaged asset? Shadow IT is anything running outside the sanctioned process. Unmanaged assets are the subset with no management tooling on them, which includes assets IT knows about but never onboarded.

Can shadow IT be discovered without deploying agents? Yes, and it has to be. An agent goes onto assets that are already known. Shadow assets are found through the traces they leave in cloud APIs, identity systems, network records and billing.

Should shadow IT simply be shut down? Rarely as a first move. It usually indicates the sanctioned path was too slow for the work. Triage first — decommission, adopt, or record and assign an owner — and treat the underlying cause separately.

Sources

• CIS, Critical Security Controls v8.1, Control 1: Inventory and Control of Enterprise Assets, 2024.
• NIST, SP 800-53 Rev. 5, control CM-8 System Component Inventory, 2020.
• Gartner, Hype Cycle for Security Operations, 2024.
• Cloud Security Alliance, Top Threats to Cloud Computing, 2024.
• Verizon, 2026 Data Breach Investigations Report.