Shadow IT is any system in use at a company that the technology team did not approve and often does not know exists. It is rarely malicious. It is usually somebody solving a real problem with a free trial because the official process would have taken six weeks.
The security problem is not that the tool is bad. It is that company data is now somewhere nobody is watching, under terms nobody read, with access nobody can revoke.
Why Shadow IT Keeps Happening
People adopt shadow tools for good reasons. The approved tool is slow, or missing a feature, or the approval queue is long, and there is a deadline on Friday.
Security teams that respond by banning everything get a predictable result: the usage does not stop, it just stops being visible. The teams that do better treat discovery as an ongoing measurement problem and make the approved path genuinely easier than the unapproved one.
Finding Shadow SaaS in Your Own Logs
You already have the evidence. DNS query logs show which hostnames your users resolve. Web proxy or firewall logs show which destinations they reach. Identity provider logs show which applications people signed into with a company account.
In the lab you take those logs and turn them into a ranked list of services in use, then separate the approved from the unknown. It is a data problem more than a security problem, which is why it makes such a good exercise: the work is grep, sort, uniq, and judgment.
Commercial discovery is usually done by a cloud access security broker or a secure web gateway. See SASE and SSE for how those products fit together.
Shadow AI, The Newer Version of the Same Problem
Generative AI assistants made shadow IT sharper. The interface is a text box, the sign up is instant, and the natural use case is pasting in whatever you are currently working on. That is how source code, customer lists, contracts, and incident details end up in a service the company never assessed.
The risks worth naming precisely are data leaving your control, output being wrong in ways that are hard to notice, and the growing category of AI features quietly added to tools you already use. That last one is easy to miss, because nobody signed up for anything.
Our shadow AI guide goes deeper, including how to write a usable policy.
Governing AI Use Without Banning It
A ban is a policy that measures nothing and changes little. The workable pattern is a short list of approved tools, a clear statement of what data may never be pasted anywhere, an easy way to request something new, and monitoring to see what is actually happening.
Enterprise agreements matter here. Business and enterprise tiers from major providers such as Anthropic, OpenAI, Microsoft, and Google generally offer different data handling terms than consumer tiers. Reading the actual terms is part of the job.
The Challenge: Hunt the Shadow IT
You are given log data and asked to find what is in use, decide what matters, and write it up for somebody who has to make a decision about it.
The write up is graded as hard as the hunt. A list of 200 domains is not a finding. Three services holding company data with no agreement in place, named, with evidence, is a finding.
Learn This at HackRange
This week connects directly to Week 11 on generative AI in security operations, and to the AI governance material in the learning center.