Enterprises expected SaaS to simplify their IT infrastructure. In many ways, it did – but it also created an entirely new attack surface. Most departments now rely on a mix of sanctioned and unsanctioned SaaS applications – and even the sanctioned ones are often unmonitored for risk. This uncontrolled growth has evolved into a new form of Shadow IT: SaaS sprawl.

The rise of AI-powered SaaS tools has accelerated this trend even further. Users can now connect generative AI platforms to business applications like Google Drive, Slack, Microsoft OneDrive, CRM systems, and developer tools with just a few clicks – often without understanding the permissions being granted or the data being exposed.

While most organisations have adapted their identity and network controls for cloud usage, they are still unprepared for what has emerged behind the scenes: SaaS-to-SaaS integrations, AI-driven automations, OAuth permission chains, risky third-party plug-ins, and misconfigurations inside sanctioned apps.

The result is a scenario where security teams have minimal visibility and even less control.

Shadow IT, also known as the use of software, apps, or services without the knowledge or approval of the IT department, has become standard practice within businesses everywhere. Whether it’s HR deploying a cloud-based hiring tool, marketing teams embracing a new analytics platform or developers trying out a new AI app, these actions might seem harmless, possibly even innovative.

In reality, it’s an approach that introduces some significant data management and compliance challenges, particularly given the massive growth in AI adoption, where tools are readily available for a vast range of use cases.

Thanks to the ubiquitous reliance on cloud applications, employees can easily launch tools without consulting IT with just a few clicks. As a result, the data landscape is becoming increasingly fractured and decentralised, with important information dispersed and siloed across multiple platforms and devices. This exposes organisations to dangers that are sometimes impossible to measure, making data difficult to manage, safeguard, or even locate.

The fact that employees want to adopt new tools, often for perfectly valid reasons, is not the issue. Business units are heavily focused on delivering competitive advantage, speed and agility. The problem is that moving swiftly without waiting for IT procurement cycles is made possible by SaaS, and is often too tempting for competitive BUs facing pressure to perform. However, adoption that occurs “in the shadows” always poses a risk.

For instance, without central monitoring, sensitive information can be easily uploaded to applications that lack strong security or fail to comply with relevant requirements. In many cases, they may have or duplicate features that are already present in existing products, creating unnecessary IT sprawl. Over time, this leads to increased inefficiency, spiralling costs, and compliance exposure.

Most security and IT leaders will tell you: “We have visibility into our SaaS environments.” Dashboards, audit logs, alerts—they’re all at your fingertips. So then why are three out of four organisations still experiencing SaaS security incidents, despite all that data? New data exposes a harsh reality: seeing risk is not the same as securing it.

High SaaS visibility, when not paired with enforcement, accountability, and continuous validation, can lull organisations into a dangerous sense of control. As SaaS ecosystems grow more complex, organisations need to move beyond dashboards to true, operational SaaS security.

Many organisations are unknowingly exposing themselves to major threats by allowing shadow IT to flourish.

A failure to understand how business units and individual employees are purchasing their own software and installing free applications, as well as continuing to use end of life (EOL) software, could have dire consequences. There are many cautionary tales of IT teams losing control of IT assets and being unable to stop sensitive data from being accessed by unauthorised personnel and shared on unofficial platforms.

Shadow IT can also make an organisation more vulnerable to a cyber attack and result in serious disruptions, affect compliance which leads to fines, and interrupt operations because the application does not integrate properly with a company’s IT infrastructure.

It is critical, therefore, to have an effective IT asset management strategy, and to put governance in place to discover and monitor shadow IT.

Whatever the reason, that class of software represents a risk. According to our research, nearly half (48%) of the issues on the CISA Known Exploited Vulnerabilities list are found in outdated and unsupported software, while 20% of critical assets have software installed that includes end-of-support software with known issues rated as ‘high’ or ‘critical’.

Managing this software involves a security-focused approach to asset management, which includes knowing what assets you have, who within the organisation is responsible for each asset or software in the business, and what risks that software might pose. This detail is not typically part of a traditional IT Asset Management tool, yet it is the key to prioritisation of remediation.

For all your software, consider tracking the status over time of those installations across their lifecycle, from general availability through to end-of-life or end-of-support status. Within this, you should also prepare a report on any assets that will reach end-of-life status in the next six or twelve months, allowing sufficient time for migration planning or upgrades.

For software that reaches end-of-life/end-of-support status without being replaced, there is normally a reason. When it comes to the cost of implementing changes, ensure that you have a documented business case and the corresponding implementation budget figure available.

Alongside this, you can track the Value at Risk to the business from that end-of-life software, capturing how much any potential downtime or cyber incident would represent to the business over time. You can then use this Value at Risk figure to determine if and when the cost of migration is lower than the potential risk of maintaining the status quo.