Key Takeaways
- 20-40% of SaaS spending at most companies goes to tools employees signed up for without IT approval.
- Shadow IT happens because employees need tools faster than IT can approve them. The solution is better visibility and a faster approval process, not locking everything down.
- Detection methods include expense report analysis, network monitoring, SSO log review, and automated discovery tools.
- The real risk isn't just cost. Unapproved tools create security vulnerabilities, compliance gaps, and data silos.
What is Shadow IT?
It’s the software you don’t know you have.
Fortune 500 executive mentioned it casually during a discovery meeting: “One of the recent Shadow IT findings we had? We had no idea AirTable users were out there.”
AirTable. A perfectly legitimate tool. But nobody in IT knew about it. An entire department (or multiple departments) just started using it because it solved their problem faster than going through official procurement.
The real problem? They have 6x other project management tools already in-use at this company.
This is shadow IT. And it’s everywhere.
Shadow IT isn’t malicious. It’s not employees trying to circumvent security. It’s employees trying to solve problems quickly. Marketing finds a tool that’s better than what IT provided. Sales discovers a collaboration platform that fits their workflow. Design uses an app that integrates with their existing stack.
Meanwhile, IT is in the dark. They can’t track spend. They can’t manage security. They can’t consolidate licenses. And they definitely can’t make informed decisions about their tech stack.
Why Shadow IT Happens (And Why It’s Growing)
The conditions are perfect for shadow IT to flourish:
1. SaaS Made Procurement Easy
20 years ago, buying software required IT approval, budgeting cycles, and implementation. Now? Credit card. Sign up. Three minutes. You’re using a tool.
2. Teams Move Fast
If official procurement takes 8 weeks and a tool takes 5 minutes to start using, guess what people do? They grab the tool. It works. It solves their problem. By the time IT realizes it exists, it’s embedded in their workflow.
3. IT’s Catalog Doesn’t Fit Everyone
IT provides Slack. But some teams prefer Microsoft Teams. IT provides Asana. But design uses Monday.com because of the Figma integration. IT provides SharePoint. But marketing uses Notion because it’s better for their content calendar.
Teams aren’t being difficult. They’re being practical. They use what works.
4. Cost is Distributed
One tool costs $50/month. A manager just approves it from their departmental budget. IT never sees it. Six months later, there are 20 of these small expenses scattered across the company, and nobody has visibility.
Ready to See Your Savings Potential?
Book a 15-minute demo to see how License Logic identifies waste and saves companies an average of $127K annually.
The Risk You’re Not Seeing
Here’s why IT actually cares:
Data Security: Unauthorized tools might not meet your security standards. You have no idea what access permissions employees are granting, what data they’re syncing, or whether that SaaS app has access to your company’s sensitive information.
One company discovered employees were using an unapproved cloud storage tool and syncing customer data to it. No data loss, but massive compliance risk. They had no way to audit or prevent it.
Compliance and Audit Risk: If you’re in healthcare, finance, or regulated industries, you need to know every tool that touches your data. Shadow IT is a compliance nightmare. When an auditor asks “do you have a record of all software with access to customer data?” and your answer is “well, probably, but not completely,” you have a problem.
Wasted Spend: You might have a corporate license for something. Meanwhile, three teams independently subscribe to competitors. You’re paying for licensing redundancy you don’t even know about.
SaaS Sprawl: One team uses Tool X for collaboration. Another uses Tool Y. A third uses Tool Z. They all do the same thing. Your organization is fragmented. Your data is scattered. Your security posture is weak.
How to Detect Shadow IT (The Complete Process)
Method 1: Network and DNS Monitoring
Your network firewall logs every website visit. Every DNS lookup. You can search these logs for SaaS domains and applications.
This requires IT infrastructure and is more technical, but it’s comprehensive. You can see every tool employees are accessing, whether they’re using it via web browser or native app.
One IT team ran a DNS analysis and discovered 47 SaaS tools active in their environment. They knew about 18 of them officially. The other 29 were shadow IT.
Method 2: Credit Card and Expense Report Analysis
Finance has data you don’t. Credit card transactions. Expense reports. Look for software-related charges:
- Recurring subscription charges
- Tools mentioned in descriptions (“Slack,” “Monday.com,” “Notion,” etc.)
- Charges to departments you wouldn’t expect to use software
One company found $240K in annual shadow IT spending just by analyzing expense reports. Tools were scattered across departments, flying under IT’s radar.
Method 3: Agent-Based Discovery (Recommended)
Deploy a lightweight agent on employee machines. The agent sees every application (on-premises and cloud-based) that employees interact with, every website they visit professionally, and every login they perform.
Unlike DNS monitoring, this gives you context: which employees are using what, how frequently, which departments, which business functions.
This is the most comprehensive approach because it’s not just “this tool exists.” It’s “this tool exists, 23 people use it, they spend an average of 8 hours per week in it, it’s being used by the design department.”
One customer deployed our License Logic agent and discovered over 200 SaaS tools in their environment. They formally knew about 80. The other 120 were shadow IT – some unused artifacts, but many actively used and business-critical.
Ready to stop shadow IT? Learn more
The Shadow IT Analysis Process
Once you detect shadow IT, here’s what to do:
Step 1: Categorize the Tools
Not all shadow IT is equal:
- Business-critical: “Wait, design is using this? We need this tool officially.”
- Redundant: “We already have a license for this. Why is marketing paying separately?”
- Personal/low-risk: “Someone’s using Grammarly. Not a security risk, low cost, low priority.”
- Security risk: “Wait, they’re using an unapproved cloud storage tool with our customer data?”
Step 2: Engage Department Heads
For business-critical tools, talk to the department: “We see you’re using Tool X heavily. Tell us what problem it solves. Let’s evaluate bringing it into our approved stack.”
For redundant tools, offer consolidation: “We can give you a license through our corporate program for $10/seat instead of you paying $15 individually.”
For security risks, set policy: “This tool doesn’t meet our security standards. You can’t use it with company data. Here’s an approved alternative.”
Step 3: Create a Shadow IT Governance Policy
Going forward, prevent shadow IT by:
- Making approved tools accessible: If your official tool is annoying, people go rogue. Make your official tools good enough that people want to use them.
- Creating a lightweight approval process: Instead of “all software requires 8-week approval,” try “all software under $500/month gets 48-hour approval.” Fast enough to be practical, controlled enough to maintain visibility.
- Centralizing software requests: “Want to use a new tool? Fill out this 2-minute form.” Now you have visibility and control without being obstructive.
- Educating employees: Most shadow IT users aren’t trying to circumvent security. They just don’t know IT policy exists. “Here’s how to request software. Here’s why we need visibility.” Most will cooperate.
Real Example: From Shadow IT to Control
One mid-market company had no visibility into their SaaS environment. They knew they were spending a lot, but couldn’t say how much or on what.
They deployed an agent-based discovery tool and ran an analysis. Results:
- 187 SaaS applications detected
- 89 applications officially approved
- 98 applications shadow IT
- $340K annual spend on shadow IT (vs. $850K on approved tools)
Of those 98 shadow IT tools:
- 12 were business-critical and got formally approved
- 34 were duplicates of approved tools (consolidation opportunity: $120K)
- 42 were low-usage or personal tools (decision: educate, don’t penalize)
- 10 were security risks (immediate action: restrict access, offer alternatives)
Within 6 months:
- Consolidated 34 duplicate tools
- Recovered $120K in wasted spending
- Formally approved 12 previously shadow IT tools
- Implemented a lightweight approval process so future shadow IT became rare
They went from chaos to control not by being restrictive, but by being smart: find the real waste, approve what’s actually valuable, educate employees on policy, and make approval fast enough to compete with shadow IT.
Want to see how this works for your company?
Book a 15-minute demo to see your personalized savings report.
How to Start Detecting Shadow IT This Week
You don’t need a complex project. Start simple:
Step 1: Analyze Expense Reports
Pull the last 6 months of company credit card or expense report data. Filter for software-related charges:
- Recurring monthly charges
- Keywords like “subscription,” “software,” vendor names
- Unusual departmental spend
You’ll probably find 15-30% shadow IT spending you never knew about.
Step 2: Ask Around
Informal survey: “What tools does your team use daily that IT might not know about?” You’ll be surprised at the answers.
Step 3: Run a DNS or Network Analysis
If you have IT infrastructure knowledge (or IT resources), analyze your firewall logs for the past 30 days. Search for SaaS domain patterns (.com domains associated with known SaaS vendors). You’ll get a list of tools in active use.
Step 4: Deploy Discovery
If the above steps confirm significant shadow IT, deploy an agent-based discovery tool like License Logic. This gives you comprehensive, contextualized data: who’s using what, how often, which departments.
The Truth About Shadow IT
Shadow IT isn’t a security problem you solve by being restrictive. You solve it by being smart:
- Detect what exists (don’t deny the problem)
- Categorize the risk (not all shadow IT is equal)
- Approve what’s valuable (the best tool is better than the “official” tool)
- Consolidate redundancy (recover easy wins)
- Educate and streamline (make legal procurement easier than shadow IT)
The companies winning this battle aren’t the ones saying “no” to everything. They’re the ones with visibility, context, and a process that’s actually fast enough to compete with employees’ ability to sign up for tools on their credit cards.
Bottom Line
Shadow IT exists in your environment right now. The question isn’t whether to detect it—it’s how fast you move once you do.
You probably have $200-500K in untracked SaaS spending. You definitely have duplicate tools you’re paying for twice. You absolutely have security blind spots.
The first step is visibility. Once you see what’s actually happening, you can make intelligent decisions instead of reactive ones.
Ready to surface your shadow IT? You can try our SaaS management solution for free.
Want to keep reading?
Frequently Asked Questions
Common questions about How to detect Shadow IT
Shadow IT is software and SaaS tools that employees use without IT's official knowledge or approval. It happens when departments solve problems faster than official IT procurement allows.
Research suggests 20-40% of SaaS spend is shadow IT. A $1M SaaS budget likely means $200-400K in unapproved tools.
Not always. Some shadow IT is low-risk (like Grammarly). But some poses serious security and compliance risks (like unapproved cloud storage). You need visibility to distinguish between them.
First, categorize by risk. Business-critical tools should be evaluated for formal approval. Duplicates should be consolidated. Security risks should be restricted. Low-risk personal tools can usually stay (with policy guidelines).
Make official procurement fast (48-hour approval for tools under $500/month), educate employees on policy, centralize software requests, and use monitoring to catch new instances early.
DNS/firewall log analysis (technical but comprehensive), expense report analysis (simple, catches obvious cases), agent-based discovery (most comprehensive and contextualized), and employee surveys (informal but effective).