Shadow IT detection is the process of finding every device, app and cloud service your team uses for work that nobody in charge of IT has approved or even seen. For a small business, the reliable way to do it is to combine three layers: compare your network against an approved inventory, review cloud and app traffic, and ask your people what they use. Then repeat it on a schedule. This guide walks through each layer, how to judge what you find, and how to keep the list from growing back.
Key Takeaways
- Shadow IT is any hardware, software or service used for work without the knowledge, approval or control of whoever manages IT. Personal file-sharing accounts, unmanaged Wi-Fi devices and AI chat tools all count.
- No single method finds everything. Combine an asset inventory review, network and cloud discovery, and a short staff conversation.
- Detection is a recurring task. A one-time audit goes stale as soon as someone signs up for a new app.
- Every discovered app needs a decision: approve it, move it under management, or remove it.
- Unknown apps are a backup, patching and compliance problem, which matters most for dental practices, law firms and other regulated offices.
Table of Contents
- What shadow IT means in a small business
- Why people end up using it
- Why undetected shadow IT is a real risk
- The three layers of shadow IT detection
- Detection methods compared
- What to do with what you find
- Shadow AI deserves its own line on the list
- Keeping shadow IT from coming back
- When to bring in outside help
- A first-week plan
- FAQ
- Sources
What shadow IT means in a small business
The FFIEC IT Examination Handbook defines shadow IT as devices, software or services operating in an organization's environment without the knowledge, approval or control of IT management. Cisco adds that it can include cloud services, software and hardware used by a department or an individual.
In a ten-person office, that rarely looks like sabotage. It looks like this:
- A paralegal sends large files through a free personal file-sharing account because the firm's system is slow.
- A front-desk employee installs a scheduling app on a personal phone to text patients.
- A manager signs up for a free PDF or e-signature tool with a work email.
- Someone plugs a wireless router into a wall jack to get better coverage in the back office.
- A team pastes client notes into an AI chatbot to draft a letter.
That last one is shadow AI. The UK's National Cyber Security Centre notes that shadow IT can include AI technologies used without permission, and it treats shadow AI as part of the same problem. The detection methods below apply to both.
Why people end up using it
IBM explains that employees adopt shadow IT because they can start right away without waiting for approval, or because the tool does the job better than the approved option. Both reasons are about getting work done, not about ignoring rules.
That shapes how you should detect it. If detection feels like a hunt for offenders, people hide tools. If it feels like finding gaps in what you provide, they tell you. A practical look at the kinds of gaps that push people toward their own tools is in this overview of modular SaaS for small businesses, which shows how one set of connected tools can cover scheduling, invoicing and customer records.
Why undetected shadow IT is a real risk
The FFIEC handbook lists consequences that apply well beyond banks:
- Security weaknesses that can lead to data breaches or data loss.
- Software and devices you cannot patch because you do not know they exist.
- Devices and software you cannot back up or recover.
- Malware that spreads unintentionally, for example through automatic backups.
- Software license penalties.
- Legal risks tied to data use and data ownership.
- The potential nullification of cyber insurance.
IBM makes a related point about recovery: data in shadow tools may not be included in the backups of your approved systems, so it can be hard to restore. It also notes that data scattered across unmanaged assets becomes inconsistent. If a client file lives in three places and only one is backed up, you do not have a backup of that file.
For a dental practice handling patient records or a law firm holding privileged documents, an unapproved app that stores client data is a compliance question as well as a security one. We cover the cost side of this in our post on shadow IT risks and a 30-60-90 day plan for small business IT teams.
The three layers of shadow IT detection
Security vendors that write about discovery agree on one point, and Adaptive Security states it clearly: no single technique catches everything, so dependable programs layer several methods and run them continuously. For a small business, three layers cover most of the ground.
Layer 1: Compare the network to your inventory
The FFIEC advises regularly reviewing network assets against approved inventories and network diagrams. The CISA Cybersecurity Performance Goals go further. Their asset inventory outcome aims to identify known, unknown (shadow) and unmanaged assets, and recommends keeping an inventory of all assets with an IP address updated at least monthly.
In practice:
- Build the approved list: every computer, phone, printer, switch, access point, camera and server the business owns or authorizes.
- Scan the network for everything that actually has an address.
- Match the two lists. Anything on the network and not on the list is a question to answer.
- Look specifically for rogue Wi-Fi access points and IoT devices. The FFIEC names unauthorized IoT devices and rogue Wi-Fi connections as things detection tools can surface.
This layer finds hardware well. It finds software only when that software generates network traffic you can inspect, which is why you need the next layer.
Layer 2: Review cloud and app usage
Most shadow IT today is cloud software, not hardware. The FFIEC suggests cloud-connected tools such as cloud access security brokers (CASBs) to discover unknown applications.
Microsoft's tutorial on discovering shadow IT shows what this looks like in a Microsoft environment. Cloud discovery identifies the apps being used, shows their risk levels and produces continuous reports. Microsoft says you can start by integrating with Microsoft Defender for Endpoint, which collects cloud traffic data from Windows devices on and off your network. For broader coverage, you can add a log collector on firewalls or proxies.
If your business runs on Microsoft 365, check which of these controls your licenses include and who is looking at the reports. Many small offices own the capability and never turn it on.
Layer 3: Ask people, and read the bills
Tools miss things: apps used on personal phones over mobile data, free accounts that never touch the office network, tools paid for with a personal card. Three low-tech checks fill that gap:
- A short staff survey. Ask which apps and sites people use to get work done, and promise that the goal is to fix gaps, not assign blame.
- Expense and card statements. Recurring charges for software that is not on your approved list are a reliable sign.
- Email sign-up confirmations. Search the shared and admin mailboxes for welcome and verification messages from services you do not recognize.
Detection methods compared
| Method | What it finds | What it misses | Effort for a small office |
|---|---|---|---|
| Asset inventory vs. network scan | Unknown computers, rogue access points, IoT devices | Cloud apps used on approved devices | Low to moderate, monthly |
| Cloud and app discovery (endpoint, firewall or proxy logs, CASB) | Cloud and SaaS apps, risk levels | Apps used on personal devices off your network | Moderate, then continuous |
| Staff survey | Tools used for convenience, personal-phone apps | Anything people forget or avoid mentioning | Low, quarterly or twice a year |
| Expense and email review | Paid and sign-up-based tools | Free tools with no billing or sign-up email | Low, monthly |
What to do with what you find
A list of unknown apps is only the start. The FFIEC says management should assess each item's security risks and intent, the reason it is being used, which clients or processes it supports, and its integrations. Then decide whether to remove it or move it into managed infrastructure and asset management, and review your policies, processes and tools for the gaps that let it in.
A simple triage works for most small businesses:
- Ask what job it does. The reason for use tells you what the approved tools are missing.
- Check what data it touches. Client records, patient information, financial data and credentials raise the stakes.
- Check its risk and compliance posture. Microsoft's guidance describes using the Defender for Cloud Apps catalog to see risk scores, filter to lower-scoring apps, and check whether an app is certified against standards such as HIPAA or SOC 2. A certification on a vendor's page is a starting point for your own review, not the end of it.
- Choose an outcome. Approve it and add it to the inventory, replace it with a managed tool that does the same job, or remove it and move the data out safely.
- Make sure it is backed up. If you approve an app that holds business records, confirm it is covered by your backup and recovery plan.
Step 4 matters most. If you remove a tool without offering a working replacement, it comes back under another name within weeks.
Shadow AI deserves its own line on the list
Generative AI tools spread faster than most software, and the risk is easy to miss: the data leaves the moment someone pastes it into a prompt. Treat AI tools like any other app in your triage. Decide which are approved, what kinds of data may never be entered, and whether the account is a business account you control. Put those rules in writing and include them in your staff briefing.
Keeping shadow IT from coming back
The FFIEC recommends IT governance practices, security controls, consistent policies, standards and procedures, and awareness training that covers shadow IT risks and how to report it. For a small team, that translates into a short, workable routine:
- A one-page acceptable use policy. List approved tools, say how to request a new one, and name who answers within a business day.
- A fast approval path. If requesting a tool takes two weeks, people will skip the request. A same-week answer removes the main reason for shadow IT.
- Onboarding and offboarding checklists. New hires get approved accounts and a briefing. Departing staff lose access to every approved tool, and you ask what else they used.
- A monthly review. Compare inventory to network, glance at the cloud app report, check expense lines. Thirty minutes a month beats a yearly scramble.
- Training with examples. Show staff the real scenarios above rather than abstract warnings.
Our post on common IT mistakes small businesses make covers related habits, and our small business IT services checklist is a useful way to see where your own setup stands.
When to bring in outside help
Detection works best when someone owns it and runs it on schedule. In a small office, that owner is often an office manager who also handles payroll and ordering supplies. If that is you, handing the monitoring to a managed provider is a reasonable way to make sure it gets done.
Great Plains Networking provides managed IT support for small businesses in Norman, Moore and Oklahoma City, including 24/7 monitoring, cybersecurity, Microsoft 365 support and network management. We work with dental practices, law firms, accounting firms, manufacturers and nonprofits, explain things in plain language and do not require long-term contracts.
If you want a starting picture of what is on your network, our free network assessment is the place to begin.
You can request the free network assessment or take the 10-minute readiness audit to see where your IT stands today.
A first-week plan
If you want to start now, this sequence fits into a week without special tools:
- Day 1: Write down every device and business app you know about. This is your approved inventory.
- Day 2: Pull the last three months of card and expense statements and flag unfamiliar software charges.
- Day 3: Send the staff survey with a clear no-blame message.
- Day 4: Check your router or firewall for a list of connected devices and compare it to the inventory.
- Day 5: Triage the findings: approve, replace or remove, and set a date for the monthly review.
The point is not a perfect list on day five. It is a repeatable habit that keeps the list accurate.
FAQ
How do you detect shadow IT?
Combine three layers: compare network devices to an approved inventory, review cloud and app traffic with discovery tools, and ask staff and check expenses for tools those methods miss. Run the process regularly, because new apps appear constantly. No single method catches everything.
What does shadow IT mean in cybersecurity?
It means IT devices, software or services used inside an organization without the knowledge, approval or control of IT management, as the FFIEC defines it. The security concern is that unknown assets are not patched, monitored or backed up.
What is the difference between shadow IT and shadow AI?
Shadow AI is a form of shadow IT: AI tools used for work without permission. It adds a specific risk because business data can be entered into a tool the organization does not control. Detect and assess it the same way as other unapproved apps.
Why do employees use shadow IT?
Usually to get work done faster. They can start using a tool immediately without waiting for approval, or the tool offers better functionality than the approved option. Fixing those gaps and keeping approval quick reduces it more than strict rules alone.
Sources
- FFIEC IT Examination Handbook: Shadow IT
- Cisco: What Is Shadow IT?
- IBM: What Is Shadow IT?
- UK NCSC: Shadow IT
- CISA: Cybersecurity Performance Goals
- Microsoft Learn: Discover and manage Shadow IT
- Adaptive Security: Shadow IT Discovery
- What Is Modular SaaS?