The Real Risk of Shadow IT: Why IT Teams Are Always the Last to Know

Martin Snyder
Sep 30
3 min read

The Real Risk of Shadow IT: Why IT Teams Are Always the Last to Know

Shadow IT isn’t a rebel—it’s a routine. Teams adopt tools to move faster, then those “quick wins” quietly turn into risk. Waldo Security makes that risk visible: we discover every SaaS app, tenant, account, and OAuth connection in minutes, including AI plug-ins, so you can enforce SSO/MFA, right-size scopes, automate offboarding, and export audit-ready evidence. Start with Instant SaaS Discovery to replace guesswork with facts.

Why the surprises keep coming

There are more apps than you think. Okta reports the average company now runs ~101 apps, a milestone first; BetterCloud still finds ~106 apps in use. Even “consolidators” have sprawl. (Okta)
The old front door is still the easiest in. In the 2025 Verizon DBIR, 88% of Basic Web Application Attacks involved stolen credentials—anything outside SSO/MFA is low-hanging fruit. (Verizon)
Shadow AI multiplies identities. Netskope’s 2025 data shows the average org uses 9.6 genAI apps, often adopted ahead of policy. (Netskope)

Translation: you can’t govern what you can’t see. Public guidance says the same: start with inventory + least privilege + logging—then everything else works. (CISA)

How Shadow IT leaks data—without a “breach”

OAuth consent sprawl. A friendly “Sign in with …” can grant broad write scopes and durable access (offline_access), so tokens keep working after password changes.
Duplicate tenants and unmanaged workspaces. Pilots become production with local passwords and default sharing.
Personal accounts and external guests. SSO exists, but not enforced for every path; guests accrue editor/admin rights and get missed at offboarding.
Public links and plug-ins. “Anyone with the link” plus AI/extension copy-paste equals untracked egress.

None of this looks like a movie-style hack; it’s normal usage in places you don’t monitor, which is why credential-driven web-app abuse remains so successful. (Verizon)

The playbook that actually works:

See → Fix → Prove

1) SEE what’s real (not just what’s integrated)

Aggregate IdP sign-ins, email/collab logs, DNS/proxy, browser extensions, and spend into one deduped inventory of apps, tenants, accounts, and OAuth grants. Tag each with owner, SSO/MFA status, admin count, risky scopes, and data sensitivity. This is the bedrock CISA emphasizes for cloud/SaaS. (CISA)

With Waldo, discovery surfaces sanctioned and shadow SaaS (including genAI) in minutes—no spreadsheets.

2) FIX the blast radius fast

Make SSO real. Enforce SSO/MFA for high-sensitivity apps first; alert on password logins to “SSO-only” apps. (Closes the DBIR’s favorite door.) (Verizon)
Govern OAuth. Restrict end-user consent to verified publishers and low-risk scopes; require admin approval for tenant-wide/write scopes; revoke idle refresh tokens.
Control sharing & guests. Default-deny public links in sensitive areas; restrict external domain sharing; time-box guest elevations.
Tame shadow AI. Allowlist trusted genAI apps and coach users in-line instead of blanket-blocking. Netskope’s usage trend shows governance, not whack-a-mole, wins. (Netskope)

3) PROVE it continuously

Stream SaaS audit logs to your SIEM and export a monthly packet: SSO/MFA coverage, admin changes, OAuth diffs, offboarding timestamps, and sharing exceptions. Faster identification and containment lowers breach cost—which IBM’s data backs up. (IBM)

Waldo’s SaaS Compliance Overview turns this into one-click, framework-aligned evidence.

A 30-day plan you can actually finish

Week 1 — Map it. Run discovery; tag owners, auth method, scopes, admins, sensitivity. Flag apps with usage or spend but no SSO and grants with broad write scopes + offline_access.

Week 2 — Stabilize it. Enforce SSO/MFA on top-risk apps; remove stale admins; restrict user consent; bulk-revoke unused refresh tokens.

Week 3 — Seal egress. Turn off public links in sensitive spaces; time-box guest roles; publish a genAI allowlist with in-line coaching.

Week 4 — Prove it. Wire logs to SIEM; enable drift alerts (new apps, admins, high-privilege grants, public links); ship your first monthly evidence packet.

KPIs that show the shadow is shrinking

Unknown → Known: % of traffic/spend tied to inventoried apps.
SSO coverage: % of high-risk apps enforcing SSO/MFA.
OAuth health: # of high-privilege grants (esp. with offline_access); % reduced month-over-month.
Guest hygiene: # of external identities with admin/export roles.
Evidence freshness: % of artifacts updated in the last 30 days.

Bottom line

Shadow IT isn’t “bad behavior”; it’s the predictable result of many apps, fast teams, and easy consent. The risk is quiet, durable access your dashboards miss—until an invoice or an incident. The fix is a loop: see everything, shrink the blast radius, and keep the receipts. Waldo makes that loop routine instead of heroic—start with Instant SaaS Discovery, then keep proof clean with the SaaS Compliance Overview.

Further reading: Okta Businesses at Work 2025; BetterCloud State of SaaS 2025; Verizon 2025 DBIR; Netskope Cloud & Threat Report 2025; IBM Cost of a Data Breach 2025; CISA Cloud Security Technical Reference Architecture. (Okta)