What is shadow IT? Definition, examples, risks, and how to manage it

What is shadow IT?

Shadow IT is any technology employees use for work without the knowledge or approval of IT and security teams. Today it's mostly shadow SaaS: Web apps and AI tools employees sign up for themselves, often with a password instead of SSO, along with the browser extensions and OAuth integrations that connect them to corporate data.

The term used to mean a server under someone's desk or an unapproved laptop on the network. Those still count, and the UK's NCSC includes unmanaged devices in its shadow IT guidance. But most work now happens in web apps, and anyone with a work email address can sign up for one in under a minute, so the bulk of shadow IT has moved into the browser.

It's also more common than most security teams assume. Microsoft says 80% of employees use non-sanctioned apps that nobody has reviewed. In 1Password's research, 52% of employees said they'd created accounts for AI tools and SaaS apps without IT approval, and 34% of company apps sit outside SSO.

Shadow SaaS and shadow AI

Shadow SaaS is the subset of shadow IT made up of cloud apps, such as a project tracker a team signed up for on a free plan or a file-sharing service used to send a document to a customer. It's the largest and fastest-changing part of shadow IT, because new SaaS apps launch constantly and most offer a free tier designed to be adopted without asking anyone.

Shadow AI is the newest part of the same problem. It covers unapproved AI apps, personal accounts on AI tools the company already pays for, AI browser extensions, and AI apps connected to corporate systems through OAuth. In an average week, Push sees 16 unique AI apps, 17 AI browser extensions, and 17 AI OAuth integrations in use at the average organization. Shadow AI isn't a separate category so much as shadow SaaS moving faster, and the same discovery and governance approach applies to both.

Shadow IT examples

Most shadow IT looks ordinary, which is why it goes unnoticed. Typical examples include:

• Project management tools a team signed up for with a work email and a password, outside SSO

• Personal ChatGPT or Claude accounts used for work alongside the company's licensed one

• An AI note-taker connected to Microsoft 365 or Google Workspace through OAuth, with access to calendars and email

• Personal Dropbox or Google Drive accounts used to share files with customers or work from home

• Browser extensions that can read every page an employee opens

• Second tenants of approved apps, such as a team's own Slack workspace or Notion account

• A free trial that was never cancelled and still holds company data

None of these involves an employee trying to cause harm. Each one creates an account, a copy of company data, or a connection to corporate systems that the security team doesn't know about.

Why employees use shadow IT

People turn to shadow IT to get their work done. The approved tool doesn't do what they need, the procurement process takes weeks, or there's no approved tool at all for a new task like transcribing meetings or summarizing documents. A free plan that works today beats a request that might be approved next month.

That's also the case for treating shadow IT as useful information rather than a disciplinary issue. The apps employees adopt on their own show where the official toolset falls short, and some of them deserve to become sanctioned tools. As the NCSC puts it, security teams should take "a positive and no-blame approach," because staff who fear punishment stop telling you what they use, and you end up with even less visibility.

The risks of shadow IT

The risk of shadow IT isn't that employees use apps IT didn't choose. It's that nobody is checking how those apps are accessed, what they're connected to, or what happens to them when people leave.

Unmanaged accounts are easy to take over. Apps adopted outside the identity provider usually rely on a password, and nothing centrally enforces MFA on them. Across the last million logins Push observed, 1 in 4 were password logins rather than SSO, 2 in 5 weren't protected by MFA, and 1 in 5 used a weak, breached, or reused password. Even apps later moved to SSO can keep their old password login working alongside it, creating ghost logins that attackers use with stolen credentials. Missing MFA and ghost logins are how attackers used stolen credentials to break into the accounts of about 165 Snowflake customers in 2024.

OAuth integrations extend access to third parties. When an employee connects an app to Microsoft 365, Google Workspace, or Salesforce, that app holds a token with ongoing access to corporate data. If the app's vendor is breached, so is everyone connected to it. In 2025, attackers stole OAuth tokens from Salesloft's Drift integration and used them to reach data in customers' Salesforce and Google Workspace environments, in a campaign the attackers claimed affected more than 1,000 organizations.

Data ends up with vendors nobody vetted. Customer records pasted into a free AI tool or uploaded to a personal file-sharing account sit outside your retention, DLP, and access controls. You can't tell a regulator or customer where that data is if you don't know the app exists. And when that vendor is breached, so are you: In the Vercel breach, an employee had connected a consumer AI app to the company's Google Workspace, and when the AI vendor was compromised, attackers used its stored OAuth tokens to reach internal dashboards, API keys, and code repository tokens.

Access outlives employment. Accounts created outside the identity provider aren't part of offboarding. When someone leaves, their SSO access is revoked, but the accounts they created with a password stay active, along with any data and integrations attached to them.

Compliance depends on apps you can't see. Standards and regulations increasingly expect MFA on every app that holds company data, not only the ones behind SSO. Since April 2026, Cyber Essentials has treated any cloud service accessed with a business account as in scope, and an assessment fails if a service offers MFA that isn't turned on. NYDFS Part 500 has required MFA for all access to a covered firm's information systems since November 2025. An identity provider can only evidence the apps federated through it, so a compliance report built from IdP data describes the managed estate, not the one employees actually use.

How to detect shadow IT

Shadow IT detection depends on where you collect data from. There are four traditional approaches, and each one sees a different slice of the apps employees use.

• Identity provider and OAuth logs. Microsoft 365 and Google Workspace record the apps employees have connected with "Sign in with Microsoft" or "Sign in with Google," along with the OAuth permissions those apps hold. That only covers apps connected to the identity provider. Anything an employee signs up for with a password or a personal email address never appears.

• Finance and expense data. Expense reports and procurement records show apps someone paid for, and who paid. They miss free plans, trials, and most AI tools, which is where a lot of shadow IT starts.

• Network traffic. A CASB, secure web gateway, firewall, or DNS filter logs which cloud services devices reach, but only for traffic routed through it, so unmanaged devices and off-network use drop out. It shows that someone reached an app, not how they signed in, and as the NCSC notes, it can't tell a personal account on an approved app from a corporate one without breaking encrypted connections.

• Email. Some tools scan inboxes for sign-up and billing emails from SaaS vendors. That finds accounts created with a work email address, but not personal-email sign-ups, and says little about how each account is secured or used.

The browser gives the most complete picture, because that's where employees use SaaS and AI apps. A browser extension sees the web apps people use and every login to them as it happens, including free tools, password sign-ups, personal accounts, and activity on unmanaged devices running the extension.

It also captures the context the other approaches miss: which account someone used, whether they signed in with SSO or a password, how the account is protected by MFA, and which OAuth permissions they granted. That context is also what lets you prioritize, since a password login without MFA to an app holding customer data matters more than a free design tool. A browser extension won't see desktop apps or license spend, so finance and SaaS management data still have a role there.

How to manage shadow IT

Discovery tells you what exists. Managing shadow IT is the ongoing work of deciding what to do about each app, and making the approved path easier than the workaround.

Keep a live inventory. A one-off audit goes stale within weeks, because employees sign up for new apps every day. Continuous discovery lets you see new apps as they appear, while there's still time to steer people before a team depends on a tool.

Decide app by app. For each app, choose whether to approve it, replace it with a sanctioned alternative, or block it. Many apps should simply be approved and brought under SSO. Consolidating overlapping tools also cuts SaaS sprawl and spend.

Use guardrails rather than blanket blocks. Blocking whole categories at the network tends to push usage onto personal devices, where you lose sight of it entirely. Guardrails at the moment someone reaches an app work better: A banner pointing to the approved tool, a prompt to sign in with SSO instead of a password or to add MFA, or a block for the apps that are genuinely too risky.

Lock down OAuth consent. Require admin approval for new OAuth integrations in Microsoft 365 and Google Workspace, review the ones already granted, and remove anything that's no longer used or asks for more access than it needs.

Close the offboarding gap. Make sure the accounts and integrations people created outside the identity provider are part of your leaver process.

Make requests fast. If getting a new tool approved takes weeks, people will keep working around the process. A short request form with a quick security review removes most of the reason shadow IT exists in the first place.

What to include in a shadow IT policy

A shadow IT policy sets out how employees can get the tools they need without creating risk. Keep it short enough that people will read it, and cover:

• Approved apps. A published list of sanctioned tools for common tasks, including AI tools.

• How to request a new app. Who to ask, what information to provide, and how long a decision takes.

• AI tool rules. Which AI tools are approved, which data can and can't go into them, and whether personal AI accounts are allowed for work.

• Sign-in requirements. Use SSO where an app supports it, use MFA everywhere else, and don't reuse passwords.

• OAuth and extensions. Which integrations and browser extensions need approval before employees connect or install them.

• Personal accounts. Whether personal accounts can be used for work, and on which apps.

• What happens next. How the security team will handle apps it discovers, framed as review rather than punishment.

How Push helps

Push discovers shadow IT from the browser. As a browser extension, it sees the web apps employees use on managed and unmanaged devices and every login to them. For each one, it records the account used, the sign-in method, how the account is protected by MFA and with which method, and whether the password is weak, reused, or breached. Push also captures OAuth consents as they're granted, flags ghost logins and shared accounts, and lets security teams warn, block, or steer users to approved apps in real time.

That gives you the most accurate measure of how well you're meeting security requirements, whether they come from internal policy, a standard like Cyber Essentials, or a regulator. Rather than relying on the partial picture in your identity provider, Push shows MFA, SSO, and password posture for every app and account it sees, prompts employees in the browser to fix the gaps, and gives you an accurate record to show auditors. Learn more about how Push secures shadow SaaS.

Learn more about Push Security

Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required.

Security teams use Push to detect and stop advanced browser-based attacks like AiTM phishing, ClickFix, and session hijacking; gain visibility and control over AI tool usage across their workforce; harden identities by surfacing credential reuse, SSO gaps, and shadow IT; and support data loss and insider investigations with browser-layer telemetry that other tools can't see.

Book a live demo to learn more.