The Scale of Shadow IT in 2026
Gartner estimates that shadow IT accounts for 30-40% of IT spending in large enterprises. Cisco's Annual Internet Report found that the average organisation has 15-22x more cloud services in use than the IT department has sanctioned. These are not just employees using personal Dropbox accounts. Shadow IT in the security context means unmanaged internet-facing infrastructure: the staging server that was never decommissioned, the subdomain pointed at a legacy CMS, the API endpoint deployed by a contractor who left two years ago, the cloud storage bucket created for a one-off data migration. Each of these assets is visible to anyone scanning the internet — including automated attack tools that map targets 24 hours a day.
Real-World Shadow IT Breaches
The Capital One breach in 2019 originated from a misconfigured WAF on a forgotten cloud resource. The Twitch source code leak in 2021 was traced to an improperly secured internal server that was exposed to the internet. In 2024, a major UK law firm suffered a data breach through a test environment that had been running with production data and default credentials for 18 months. The common thread is not sophisticated hacking — it is overlooked infrastructure. Attackers increasingly use automated tools that continuously scan the internet for newly exposed assets. Shodan indexes new devices within hours of them appearing online. An asset your team forgot about is an asset an attacker will find.
- Capital One (2019): misconfigured WAF on forgotten cloud resource — 106 million records
- Twitch (2021): exposed internal server — full source code leak
- MOVEit (2023): zero-day in widely deployed but poorly monitored file transfer tool
- Average time from shadow IT deployment to attacker discovery: days to weeks
Why Traditional Approaches Fail
Manual asset inventories are outdated within hours of completion. Spreadsheet-based tracking relies on humans remembering to update records every time infrastructure changes — which in cloud-native organisations happens multiple times per day. Network scanning tools only find assets on known IP ranges, missing cloud resources deployed outside sanctioned accounts. CMDB (Configuration Management Database) systems depend on accurate inputs and integration with every deployment pipeline, which rarely exists in practice. The fundamental problem is that discovery must be continuous and attacker-perspective, not periodic and internally-focused.
How EASM Eliminates Shadow IT Blind Spots
External Attack Surface Management platforms like Hadrian solve shadow IT by working from the outside in — the same perspective an attacker has. Starting from your known domains and IP ranges, the platform maps outward using DNS enumeration, certificate transparency logs, web crawling, and cloud provider API integration. It discovers every asset that is publicly reachable and associated with your organisation, regardless of whether it exists in your CMDB. Newly discovered assets trigger automatic alerts with risk classification. The security team sees what was found, when it appeared, and what risk it poses. At Kyanite Blue, shadow IT discovery is one of the most immediate value deliverables when we deploy Hadrian — clients routinely discover 20-40% more internet-facing assets than they knew existed.
Frequently Asked Questions
What is shadow IT?
Shadow IT refers to any technology — hardware, software, cloud services, or infrastructure — used within an organisation without the knowledge or approval of the IT or security team. In a security context, it specifically means internet-facing assets that are not included in the organisation's asset inventory and therefore not monitored or protected.
How do I discover shadow IT in my organisation?
The most effective approach is External Attack Surface Management (EASM). Platforms like Hadrian continuously scan from the attacker's perspective to discover all internet-facing assets associated with your organisation. This catches forgotten subdomains, rogue cloud instances, and legacy infrastructure that internal tools miss.
Is shadow IT always malicious?
No. Most shadow IT is created by well-meaning employees or teams trying to move fast. A developer spins up a test server, a marketing team creates a landing page, a contractor deploys an API endpoint. The risk is not intent — it is that these assets exist outside security monitoring and often lack proper hardening.