How to Find Shadow IT

Table of Contents

In the past few years, so much focus has been on the move to the cloud. Not anymore. 

2020 was the year of cybersecurity, compliance, personally identifiable information (PII) awareness, GDPR, and remote work. The cloud hype has changed.

Now people want to know how to maintain and manage the new SaaS-heavy environment they see in their organizations.

When you drill down into why that’s the case, you see two words mentioned time and time again: security and compliance. 

It isn’t surprising in today’s world, but as worries, concerns, and challenges are all laid out on the table, one thing is often missing. The elephant in the room–two words that when combined have become taboo in tech circles.

Shadow IT.

What Is Shadow IT?

Gartner has found that shadow IT can account for 30 to 40% of IT spend in large organizations. 

Such a large amount should be enough to scare any IT executive. But what exactly is shadow IT?

Shadow IT refers to software that is built, deployed, maintained, and managed without the involvement of an organization’s IT department.

The accessibility and prevalence of SaaS tools–they’re just a few clicks away–means that employees can bypass security controls.

In other words, all you need is a laptop, an internet connection, and a credit card and an employee can get started more quickly and less expensively than going through official IT channels. 

This leads to a host of problems, from unsecured data to compliance headaches.

How Do You Find Shadow IT?

Telling staff not to sign up to SaaS apps “because they can’t” will likely get you nowhere. That’s especially the case if they see no other option to enable their work.

Plus, as we’ve written before, sometimes Shadow IT can make your employees more productive. That’s because:

  • Shadow IT solutions often fill a gap between what’s available to the employee and what they need.
  • Employees are generally happier and more productive when they’re able to use the tools they know and like. (Some companies even list it in their job postings as a benefit — further proving how critical the right tools are to attracting and retaining talent.)

What we’re getting at is that a shadow IT policy that allows employees to experiment with new tools while mitigating Shadow IT risks is a competitive advantage. It’s also achievable.

You can do this by bringing these apps out of the shadows using a SaaS audit. Then once you’ve found what these applications are you can either make them more secure or shutter them completely.

Regardless of the data source, our platform Augmentt Discover can extract critical SaaS usage data and provide you with actionable results using an advanced log frame analysis framework. This includes trended usage over time, by individuals or entire departments.

We’re able to do this by maintaining one of the largest known SaaS Application databases in the industry. It currently contains over 15,000 vendors and applications, including 50+ sub-categories and 20 different security, financial, and productivity and profiles.

What Happens Next?

If you want to find shadow IT in your organization, the next step for you is to sign up for a free trial here and see how it works.

To make the trial experience more meaningful, every trial account is pre-loaded with sample data. 

This data provides you the ability to experience the product’s features and functionality without the need to upload your own data until you are ready.

Author
Gavin Garbutt
Co-Founder & Chairman of Augmentt

FAQ

Using our GDAP tool & Magic Link, setting up is easy! You can integrate with your CSP partner portal in minutes
Augmentt uses a combination of Microsoft Secure Score best practices as well as industry standards such as NIST & CIS. You can use the out of box templates to get started right away and even build your own custom templates to match your client requirements.
Out of box, Augmentt comes pre-configured to not be noisy. Very few Microsoft alerts are critical in nature so you will be receiving tickets for account breaches and not minor user log related events. That said, everything is customizable and you can turn alerts on & off to match your clients’ needs.
No. You can choose to schedule alerts to any stakeholder you want and at the frequency you want or manually download reports when you need them.
Regardless of how MFA is managed across your tenants, we have you covered. Augmentt supports Conditional Access Policies, Security Defaults, Entra ID per user (Legacy) MFA as well as 3rd party MFA services like DUO.
No. You can use Augmentt to monitor and manage all clients regardless of their licensing. For environments with no premium licensing you can still provide alerts and monitoring for account breaches and configure security best practices. For environments with premium licensing, you can leverage Microsoft’s premium alerts and premium security configurations such as Conditional Access Policies.
Augmentt is one of the few vendors SOC 2 Type II, and GDPR compliant.
Site licenses to make sure you can deliver standardized service across all clients very affordably.

SUBSCRIBE for more resources

Related Content

Policy Sprawl Is Killing MSP Efficiency
Policy sprawl is quietly draining your margins, creating security gaps, and eroding client trust. The good news? Standardization is the cure.
Does Microsoft Secure Score Tell the Whole Story?
Do you have a complete understanding of your security? See why MSPs need to understand the role licensing plays in Secure Score results.
Top 10 M365 Security Best Practices for MSPs
Here are the top M365 security best practices to help you enhance protection, ensure compliance, and stay ahead of emerging threats.