You can't secure
what you can't see.
We make it visible.
A full discovery and governance assessment of the tech your employees use without IT's knowledge — unsanctioned SaaS, rogue cloud accounts, forgotten assets, personal devices, and the fastest-growing shadow category of all: generative AI. We surface every instance, classify the risk, and hand you a governance plan that people actually follow.
Every flavor of shadow. Every source of risk.
Shadow IT isn't just a rogue SaaS subscription. It's a whole spectrum — from AI chatbots to forgotten AWS accounts to the browser extension your sales team installed last Tuesday.
Shadow AI
The fastest-growing and riskiest category. Employees pasting customer lists into ChatGPT, building GPTs with proprietary data, running local LLMs.
Shadow SaaS
Unsanctioned collaboration, productivity, project-tracking, and communication tools. Signed up with work email, paid on personal cards.
Shadow Cloud
Rogue AWS / Azure / GCP accounts, personal developer sandboxes, forgotten environments still holding production data.
Shadow Data
Corporate data in personal Dropbox / Drive / Gmail / WeTransfer. PII in personal Notion workspaces. Customer exports on local drives.
Shadow Devices
BYOD laptops, personal phones, home routers, USB drives, smart speakers — endpoints connected without MDM visibility.
Shadow Dev & OAuth
Unsanctioned GitHub orgs, personal API keys, ngrok tunnels, browser extensions, third-party OAuth grants to corporate Google/MS accounts.
Discover. Classify. Govern.
A repeatable program — not a one-time spreadsheet. We establish the baseline, then leave you with an ongoing governance capability.
Scoping & Baseline
Sanctioned-app list, sensitive-data taxonomy, risk appetite, stakeholders, privacy ground-rules.
Multi-Source Collection
Proxy/DNS/firewall logs, SSO/IDP events, CASB feeds, endpoint telemetry, expense data, OAuth grants.
Network Discovery
DNS egress, SNI fingerprinting, SaaS app signatures, high-risk destinations, AI-endpoint detection.
Endpoint & Browser
Installed apps, Chrome/Edge extensions, local LLMs, dev tooling, unauthorized tunnels & VPNs.
Identity & OAuth Audit
Third-party OAuth grants on Google / Microsoft 365 / Okta. SSO app inventory, risky-scope grants.
Rogue Cloud Sweep
Billing recon, DNS sweep for forgotten envs, cross-account scan, personal-card SaaS in expense reports.
External Surface
Public repos with corp email, leaked keys, SaaS-trial registrations, domain-typo takeovers.
Risk Classification
Score each finding by data sensitivity, regulatory exposure, vendor trust, and user population.
Report & Govern
Inventory, risk ranking, sanctioning pathway, removal plan, and an ongoing governance playbook.
Twelve data sources. One unified inventory.
No single signal catches everything. We correlate across network, identity, endpoint, finance, and external sources to find what any one of them would miss.
DNS / Proxy / Firewall
egress patterns · SNI · app signatures
SSO / IDP Logs
Okta · Entra ID · Google · Ping · Auth0
CASB / SSE
Netskope · Zscaler · MDefender · DLP
Endpoint (EDR / MDM)
Installed apps · processes · tunnels · local LLMs
Browser Telemetry
Extensions · OAuth grants · sideloaded
Email / Calendar
Sign-up confirmations · invites · calendar bots
Finance / Expense
SaaS subs on personal cards · cloud bills
OAuth Grants
Google Workspace · M365 · GitHub · Slack apps
Cloud Billing
AWS Orgs · Azure MCA · GCP hierarchy anomaly
Public Code / Docs
GitHub · pastebin · Google Docs public
External Recon
DNS history · cert transparency · ASN
Human Intel
Anonymous surveys · amnesty mechanism
The fastest-moving risk on the list.
GenAI adoption outpaced governance by 18 months. Our assessment treats AI as a first-class category — because a customer contract pasted into a public chatbot is a different problem than a Zoom alternative.
Why Shadow AI Needs Its Own Lens
Traditional SaaS governance assumes a vendor of record, a contract, and predictable data flows. GenAI breaks all three — any employee can hit an API, paste sensitive data, or spin up a local model in minutes.
- PII, PHI, and trade secrets pasted into public models (often used for training)
- "Custom GPT" and agent builders shared outside the org
- Locally-run LLMs (Ollama, LM Studio) on unmanaged laptops
- AI-powered browser extensions scraping and uploading page content
- API keys in code leaking through AI coding assistants
- Employee-built "AI automations" with access to inboxes, drives, calendars
Not all shadow is equal.
We classify each finding on a four-tier matrix so you can separate urgent removals from low-priority sanctioning conversations.
Block & Remediate
Active data loss or regulatory violation. These get treated like a security incident — containment first, governance after.
- Regulated data (PII/PHI/PCI) in public AI or personal cloud
- Valid API keys leaked in public code
- Corporate OAuth grants to known-malicious apps
- Forgotten prod data in rogue cloud accounts
Urgent Sanctioning or Removal
Material business risk, but no confirmed loss. Typical path: sanction officially with controls, migrate data, or deprovision.
- Unsanctioned SaaS holding customer data
- Personal file-share usage by executives
- Developer-workflow tools with broad OAuth scope
- BYOD with access to crown-jewel systems
Review & Govern
Legitimate business utility, minor compliance friction. Decide: onboard to procurement, consolidate with sanctioned alternatives, or accept-risk.
- Productivity tools duplicating existing stack
- Low-sensitivity automation & no-code
- Marketing SaaS paid by cost center
- Browser extensions with moderate permissions
Document & Monitor
Minimal risk, occasional use. We record them for visibility and watch for usage growth that would push them into a higher tier.
- Read-only reference sites & calculators
- Occasional 1-2 user trials
- Public-data productivity utilities
- Deprecated but still-visible services
Controls your auditors already check.
Our deliverables map directly to the controls listed below — so the assessment doubles as evidence for your next audit cycle.
Identify function · Asset Management (ID.AM) and Risk Assessment (ID.RA).
A.5.9 inventory · A.5.23 cloud services · A.8.9 config mgmt.
Control 1 · Inventory of Enterprise Assets and Software.
Shadow AI alignment to GOVERN · MAP · MEASURE · MANAGE.
CC6.1 access · CC7.1 monitoring · CC9.2 vendor mgmt.
Records of processing · data-transfer mapping for unsanctioned processors.
§164.308(a)(1) risk analysis · BAA coverage for unsanctioned tools.
IT outsourcing & asset-inventory requirements for regulated entities.
Visibility that becomes governance.
Unified Inventory
Every discovered app, cloud account, OAuth grant, and extension — with users, first-seen, data sensitivity, and risk tier.
Risk-Ranked Remediation
Prioritized plan: block, sanction, consolidate, or accept — with SLAs, owners, and estimated effort per item.
Governance Playbook
Sanctioning workflow, procurement gates, AI-usage policy, amnesty process, and ongoing discovery cadence.
Audit-Ready Evidence
ISO 27001 / SOC 2 / DPDP control coverage for asset inventory and third-party management. Evidence pack on request.
AI-First Assessment
Dedicated Shadow AI workstream — discovery, data-class taxonomy, usage policy, and vendor-evaluation rubric.
Privacy-Respecting Method
Aggregate analytics where possible, named findings only for high-risk items. Employee amnesty mechanism — surface don't shame.
Baseline in 3 weeks. Program in 6.
Scoping & NDA
Sanctioned-app baseline, data taxonomy, data-source access, privacy ground-rules, stakeholders.
Collection Pipelines
Log ingestion, SSO & CASB export, endpoint & browser telemetry, OAuth & billing pulls.
Discovery & Correlation
Cross-source matching, deduplication, user-attribution, data-sensitivity tagging.
Classification & Report
Risk scoring, executive narrative, technical inventory, AI-specific workstream output.
Governance Design
Sanctioning workflow, AI-usage policy, procurement gates, amnesty process, OKRs.
Ongoing Discovery
Optional quarterly re-baseline, watchlist monitoring, AI-specific governance council support.
What leaders ask before we start.
Isn't shadow IT just an inventory problem?
Will this spy on employees?
Do you need to install agents or a CASB?
How do you handle Shadow AI specifically?
What if we discover something sensitive has already leaked?
How much does it cost?
Does this replace our CASB / SSE?
Find out what's running without IT knowing.
Book a free 30-minute scoping call. We'll agree on sources, scope, and AI focus — and send a fixed quote within 48 hours. Discrete. No-blame. Action-ready.