Common examples of shadow IT

  • Marketing campaign sites and microsites built by agencies on their own hosting.
  • Cloud accounts or storage buckets created on a departmental credit card.
  • Test, staging and demo environments left running after a project ends.
  • SaaS tools adopted by one team and signed up for with work email addresses.
  • Remote access tools, file sharing services and personal devices used for work.
  • Subdomains pointing at third-party services that are no longer in use.

Why shadow IT is a security risk

Shadow IT is not usually malicious. People adopt tools to get work done quickly. The problem is that the security team cannot protect what it does not know about. Unmanaged assets miss patching, monitoring, backups and access reviews, and they often hold real data. When a breach starts on an unknown asset, it also takes longer to detect and contain, because no one is watching it.

There is a compliance angle too. Under UK GDPR an organisation remains responsible for personal data held in a forgotten system, and an incomplete asset inventory weakens Cyber Essentials and ISO 27001 assessments.

How to find and manage shadow IT

  1. Discover from the outside in, using DNS records, certificate transparency logs and internet scanning to find assets linked to your domains and brand.
  2. Check identity and expense data for unsanctioned SaaS sign-ups.
  3. Assign an owner to every asset found, then decide whether to adopt it properly or retire it.
  4. Make the approved route easier than the shadow one, so teams have less reason to go around IT.

How DarkInvader helps

DarkInvader's Asset Discovery finds shadow IT from the outside, the same way an attacker would. It identifies subdomains, cloud services and hosts linked to your organisation that are missing from internal records, then monitors them for vulnerabilities and changes.

Explore Asset Discovery

Frequently asked questions

What is the difference between shadow IT and orphaned IT?

Shadow IT is unsanctioned but usually still known to someone, such as the team that set it up. Orphaned IT is what remains after that person or project has moved on, when nobody remembers the asset exists. Orphaned assets are often the more dangerous of the two.

Is shadow IT always bad?

Not always. It often shows where official tools are not meeting people's needs. The risk comes from it being invisible to security, so the goal is to bring it into view and manage it rather than simply ban it.

How do attackers find shadow IT?

The same way EASM does: by searching certificate transparency logs, enumerating subdomains, scanning IP ranges and searching code repositories and search engines for anything linked to the organisation.

Related terms and reading

Sources