Shadow IT for MSPs and In-House Teams: Detect, Score, Govern

Updated: November 2026

Shadow IT is any software, hardware, or cloud service running inside an environment without approval from the people responsible for securing it. When a marketing team signs up for three AI writing tools on a personal card, nobody in IT or at the MSP hears about it until something breaks. This guide is for MSPs and in-house IT teams: how to detect shadow IT and shadow AI, score what you find, and replace the workaround with an approved path people prefer.

TL;DR

• Definition. Shadow IT is any app, device or cloud service running without approval from the IT team or MSP that secures the environment.
• Scale. Zylo's 2026 SaaS Management Index puts employee-bought apps at 34% of the average SaaS portfolio but only 4% of SaaS spend.
• Cost. In IBM's 2025 Cost of a Data Breach report, one in five organizations had a breach tied to shadow AI, and heavy shadow AI use added about $670,000 per breach.
• Shadow AI. Unapproved AI tools, note-takers and agents, where data leaves inside a prompt. An approved AI option that's faster than the workaround beats a ban.
• Fix. Detect across identity, network, endpoint and spend, then govern with an approved catalog.

Shadow AI is the same problem with a newer name. Conrad on why banning it fails and what changes when the AI your techs use is governed.

What Shadow IT Looks Like in a Client Environment

The textbook examples are personal cloud storage, unapproved messaging apps, and BYOD laptops. Those still show up, but they're no longer where the risk concentrates. In 2026 the common finds are free-tier SaaS bought on a personal card, browser extensions with read access to every page a user opens, no-code automation platforms wired into a CRM, and AI assistants pointed at customer data.

The pattern behind all of them is the same. Someone had a job to do, the sanctioned path was slower than a credit card and a signup form, so they took the faster route. Shadow IT is a symptom of a gap between what the sanctioned stack does and what the work requires. That framing matters, because it's the difference between a governance program that works and one that gets routed around within a quarter.

There's a second pattern worth naming: shadow IT rarely stays personal. A single free-tier project management tool spreads to a team, picks up client data, and becomes load-bearing. By the time you find it, removing it breaks a workflow the business depends on. Detection speed is the whole game.

It also helps to separate the three shapes it takes, because each needs a different response. Unsanctioned SaaS is the largest category by count and usually the easiest to bring under control, since it authenticates against an identity you administer. Unmanaged hardware, meaning personal laptops, home routers used for work, and the odd device somebody plugged into a client network, is rarer but carries the worst blast radius when it goes wrong. Unapproved AI is the newest and moves fastest, partly because the tools are free and partly because using one feels like a productivity choice rather than a technology decision. A single governance policy that treats all three identically will fit none of them well.

Why the Numbers Got Worse in 2026

BetterCloud's 2023 State of SaaSOps report found 65% of SaaS apps in use were unsanctioned. Zylo's 2026 SaaS Management Index shows why the gap persists: apps bought by individual employees make up 34% of the average SaaS portfolio but only 4% of SaaS spend. That gap between usage share and spend share is the reason procurement reviews miss it. Free tiers and personal cards leave no trail in the systems finance watches.

AI made the curve steeper. Microsoft and LinkedIn's 2024 Work Trend Index found 78% of AI users bringing their own AI tools to work, and 80% at small and medium-sized companies. Gartner predicted in November 2025 that by 2030 more than 40% of organizations will have security or compliance incidents caused by unauthorized AI tools. Vendors like Nudge Security and JumpCloud have documented the same trend from different angles: unsanctioned AI is now the fastest-growing category of unmanaged software in business environments.

Then there's the money. IBM's 2025 Cost of a Data Breach report found one in five organizations had a breach tied to shadow AI, and organizations with high levels of shadow AI paid about $670,000 more per breach than those with little or none. Of the 13% that reported a breach of an AI model or application, 97% had no AI access controls in place. Shadow data was a cost driver before AI arrived: IBM's 2024 report found more than a third of breaches involved data held in unmanaged sources.

For a US-based client, the baseline matters too. IBM put the average US breach at $10.22 million in 2025. You don't need to sell that number hard. You just need to put it next to a list of forty unsanctioned apps you found in their tenant.

Shadow AI: Definition and Risks

What Is Shadow AI?

Shadow AI is any AI tool, model, browser extension or agent that staff use for work without approval from the people who secure the environment. That covers a chatbot on a personal account, an AI note-taker invited to client calls, a writing assistant connected to a shared drive, and an AI feature a vendor switched on inside an app you approved last year. In a Gartner survey of cybersecurity leaders published in November 2025, 69% said they had evidence or suspected that employees were using public generative AI at work.

It differs from classic shadow IT in three ways. The tools are free, so expense review never sees them. Data leaves inside a prompt rather than as a file, so DLP rules written for attachments and uploads can miss it. And AI arrives inside sanctioned SaaS through vendor updates, so an app that passed review can turn into a shadow AI exposure without anyone installing anything.

What Are the Risks of Shadow AI?

The risks stack up across data, access and accountability. The table pairs each one with the control that addresses it, whether you're an MSP managing client tenants or an IT team managing your own.

None of this argues for a ban. A ban pushes AI use onto personal phones, where detection gets harder. The approach that holds is an approved AI option that's faster than the workaround, with access scoped to what the job needs and usage you can see. Finding the shadow AI agents already running is the first job, and the identity and OAuth review in the detection section below covers the first pass.

Where prompts carry regulated data, data loss prevention tools with browser coverage add a second check.

The Authority Gap Between MSPs and In-House IT

Guides from IBM, CrowdStrike, Cisco and Proofpoint are written for an internal IT team that owns the environment. That team can mandate policy, block domains, and send a company-wide email on Monday morning. An MSP can't, and that changes the playbook.

An MSP sits in a position with responsibility but only borrowed authority. You get blamed for the breach. You don't get to write the HR policy. You can see the traffic but you may not have contractual permission to block it. You can find the rogue app but the person who bought it reports to a director who outranks your day-to-day contact.

This is where a lot of shadow IT programs stall. The technical discovery is the easy part. Turning a spreadsheet of unsanctioned apps into a real decision requires a client sponsor who can say yes, a documented scope that says you're allowed to look, and language in the agreement that assigns risk when the answer is no. If your MSA is silent on unapproved applications and you knew about them, silence works against you. Get the scope of monitoring, the reporting cadence, and the client's acceptance of residual risk into the agreement before the first scan, not after the first incident.

The borrowed-authority position has an upside, though. You see across every client. An unvetted AI note-taker that shows up in three tenants in the same month is a pattern an internal team would never spot. That cross-client view is the thing you can sell.

In-house IT has the opposite problem. The authority is there, but a two-week request queue pushes staff toward workarounds, and one team rarely sees across departments the way an MSP sees across clients. The fix there is speed: a published request path, an owner per app category, and a quarterly review with department heads.

Five Ways to Detect Shadow IT and What Each One Misses

No single signal finds everything. Identity logs miss anything without SSO. Network monitoring misses the laptop on home Wi-Fi. Endpoint agents miss unmanaged BYOD. Expense review misses free tiers, which is where the AI tools live. Run at least three of these in parallel and treat the overlap as your confidence score.

OAuth grant review deserves a specific call-out. In a typical Microsoft 365 or Google Workspace tenant, the single fastest win is pulling the list of third-party applications users have granted access to their work identity. A browser extension with mailbox read scope does not appear in expense reports, does not need an install, and does not care what network the user is on. That report takes about ten minutes and reliably surprises people.

If you're building this into a broader defensive layer, discovery pairs naturally with the rest of the controls in a modern MSP security stack.

The asset inventory side of the problem overlaps almost entirely with IT asset management tooling you may already be running.

The recurring misconfigurations that discovery turns up first:

Scoring What You Find Before You Touch It

A raw list of ninety applications is not useful to a client. It reads as noise, and it invites the worst possible response: block them all, break six workflows, and watch users route around you with personal devices. Score first.

Three questions sort almost everything. Does the app touch regulated or customer data? Does it hold a persistent credential or OAuth grant into a core system like email, CRM, or file storage? Is it load-bearing for a business process right now? An app that answers yes to the first two is an incident waiting for a date. An app that answers yes only to the third is a procurement conversation, not a security one.

That sorting produces four practical buckets. Sanction and secure the tools the business genuinely needs, and bring them under SSO and MFA. Replace the ones that duplicate something already licensed, which is where the cost story lives. Remove the ones with real exposure and no business case. Monitor the low-risk remainder rather than spending political capital on it.

The cost angle is the part clients hear. Duplicate subscriptions are common in the finding, and consolidating them funds the rest of the engagement. The same logic that drives a full stack audit applies inside your clients' environments, not just your own.

The Client Conversation That Decides Everything

How you present the findings determines whether you get a governance mandate or a defensive client. Lead with the business consequence and the fix, not with a list of people who broke rules. Naming individuals turns a security review into an HR problem, and the next round of shadow IT simply gets better at hiding.

Language that works: "We found 41 cloud services in use across your environment. Twelve hold customer data. Four have standing access to your email tenant. Here's what we'd sanction, what we'd replace, and what we'd shut down, with the license savings on the same page." That framing gives the client a decision to make instead of a mistake to defend.

Then close the loop on process. If people went around IT because requests took two weeks, publishing a shorter approval path does more for your risk posture than any block list. An approved catalog with a 48-hour request path removes the incentive that created the problem. Governance that only says no gets ignored quietly.

The approved catalog is worth building properly rather than as a PDF nobody opens. Keep it to the tools a given client is licensed for, note which ones are already covered by SSO and MFA, and name the sanctioned alternative for the categories where people keep going rogue. If three departments independently signed up for the same transcription tool, that category needs a sanctioned answer, not a warning. Reviewing the catalog once a quarter alongside the discovery report keeps it from going stale, and it gives the client's leadership a document they can point staff at without involving you every time.

Put the results in the quarterly business review as a recurring line item. A shadow IT count that trends down over three quarters is the cleanest proof of value an MSP can put in front of a client, and it renews contracts on its own.

Turning Discovery Into a Service Line

Shadow IT discovery works better as a productized service than as a favor. The work is repeatable, the deliverable is concrete, and the finding usually pays for the engagement through recovered license spend. Run a software license audit alongside it and the same data covers compliance.

A workable shape: a fixed-fee initial assessment covering identity, network, endpoint, and spend discovery, delivered as a scored inventory with recommendations. Then a recurring monthly fee for continuous monitoring, new-app alerting, and a quarterly report. Price the assessment against the license savings you expect to surface, and price the monitoring per seat so it scales with the client.

The 2026 version of this includes AI. Shadow AI detection is a distinct offer, and clients understand it faster than generic SaaS governance because the headlines did the selling. Discovery of AI tools, review of what data those tools receive, and a sanctioned AI policy is a package a director-level buyer can approve without a security committee.

Vendors including Augmentt, Nudge Security, and JumpCloud sell tooling into exactly this motion, which tells you the demand is validated. Your advantage over a pure software play is that you sit inside the environment already and can act on what you find.

Shadow IT for In-House Teams

An internal IT team runs the same detection with two differences: it holds the authority to act, and it owns the request queue that created the workarounds. That makes the approval path the first fix, ahead of any block list.

The policy side fits inside a broader IT governance framework built around the Govern function in NIST CSF 2.0.

Personal laptops and phones need their own rules, and a BYOD policy template gives you a starting draft.

Where Your Own Stack Fits

Detection creates the finding. Something has to act on it, and that's where fragmentation costs you. When identity data sits in one tool, endpoint telemetry in another, ticketing in a third, and the asset inventory in a spreadsheet, correlating a rogue app to a device, a user, and a ticket becomes manual work nobody has time for at scale.

Flamingo, the publisher of this guide, builds OpenFrame for that correlation problem: open, AI-native infrastructure for IT and security, where RMM, native PSA, MDM and documentation share one system, so the discovery signal, the affected device, the user and the ticket sit in the same place. The agents work inline: Fae resolves support requests and Mingo runs IT operations, including the triage that would otherwise eat a technician's afternoon. It costs $1 per device per month with 10M AI tokens included, or $0.80 on annual billing, after a 14-day free trial, with no lock-in. Whether OpenFrame fits depends on how much of your current stack you're willing to consolidate, and that's a real trade-off worth weighing.

Your First 90 Days

Start narrow. Pick two clients, run identity and OAuth discovery, and score what comes back. That takes days, not months, and it gives you a real deliverable to build the offer around.

1. Days 1 to 30. Pull OAuth grants and sign-in logs from every client tenant you already administer. Sort by data sensitivity. Get monitoring scope and residual-risk language into your MSA template.
2. Days 31 to 60. Layer DNS and endpoint discovery onto the two pilot clients. Build the scored-inventory deliverable and run the findings conversation with a client sponsor who can approve changes.
3. Days 61 to 90. Publish an approved-app catalog with a 48-hour request path, add the shadow IT count to the QBR deck, and price the assessment and monitoring tiers for the rest of your base.

In-house teams can run the same plan on their own tenant. Swap the MSA step for an AI and SaaS acceptable use policy that leadership signs, and report the shadow IT count to them instead of to a client.

Shadow IT isn't a discipline problem, whether it turns up in your own company or a client's. It's a demand signal telling you exactly which gaps in the sanctioned stack are big enough that people paid to route around them. Find them first, and you're the one who gets to close them.