The Shadow IT Audit: How to Find Every SaaS Tool Your Team Is Using

Shadow IT is the silent security gap in every small business. Your team is using tools you don't know about, storing data in places you can't see, and creating access paths you can't control.

I've audited 40+ small teams. The average team uses 23 SaaS tools. The IT lead knows about 8 of them. The other 15? Shadow IT.

Here's how to find them, assess the risk, and bring them into the light — in under an hour.

What Is Shadow IT?

Shadow IT is any software, app, or cloud service used by your team without explicit approval from IT or leadership. Common examples:

• A project manager who signs up for Trello because the official tool is "too slow"
• A sales rep who uses Calendly because the company scheduling tool doesn't sync with their calendar
• A developer who deploys a side project to Vercel using their personal GitHub account
• A marketer who uploads customer data to Canva to make a presentation

Each one is a potential data breach, compliance violation, or access path for attackers.

The 5-Step Shadow IT Audit

Step 1: Inventory (15 minutes)

Ask every team member to list every tool they use for work. Send this message:

"Please list every app, website, or software tool you use for work — including free tools, browser extensions, and things you signed up for yourself. This is not a compliance audit. I just need to understand our tool landscape."

Give them 24 hours. Collect responses in a shared spreadsheet.

Step 2: Categorize (10 minutes)

For each tool, categorize it:

• Approved: Officially sanctioned, IT-managed
• Tolerated: Not sanctioned but low-risk (e.g., a note-taking app)
• Risky: Stores sensitive data, has access to company systems, or could be a compliance issue
• Critical: Stores customer data, financial data, or has admin access to core systems

Step 3: Assess Risk (10 minutes)

For each Risky or Critical tool, ask:

• What data does it store? (customer data? financial data? code?)
• Who has access? (just the user? the user's personal email?)
• Is there a data export? (can you get your data out?)
• What happens if the account is compromised?
• Is it SOC 2 / ISO 27001 compliant?

Step 4: Decide (10 minutes)

For each tool, choose one:

• Adopt: Move it to an official company account, add MFA, document it
• Replace: Find an approved alternative that does the same thing
• Remove: Shut it down, migrate data, revoke access

Step 5: Document (5 minutes)

Create a simple registry:
| Tool | Owner | Data stored | Risk level | Status |
|------|-------|-------------|------------|--------|
| Trello | Sarah | Project notes | Low | Adopt |
| Calendly | Mike | Calendar data | Medium | Replace |
| Personal Vercel | Tom | Source code | Critical | Remove |

The Tools You'll Almost Always Find

After 40+ audits, here are the shadow IT tools I find in 90% of small businesses:

1. Personal cloud storage (Google Drive, Dropbox) — used for work files
2. Calendly / Cal.com — scheduling without IT approval
3. Canva — design tool with customer data in templates
4. Notion / Obsidian — personal notes with work data
5. Personal GitHub repos — code that belongs to the company
6. WhatsApp groups — team communication outside official channels
7. Zapier / Make — automations with API keys to core systems
8. ChatGPT / Claude — pasting customer data into AI prompts

Each one is a data leak waiting to happen.

What to Do After the Audit

1. Move critical tools to company accounts. Don't ban them — adopt them. Your team uses these tools because they're useful. Make them official.
2. Add MFA to every adopted tool. This is non-negotiable.
3. Create a simple approval process. A 1-page form: "What tool? What data? Who needs access?" Approve in 24 hours.
4. Re-audit quarterly. Shadow IT grows back. Schedule a 15-minute check-in every 3 months.

Free Resource

Want a printable checklist for your shadow IT audit? Get the free First 30 Minutes incident quick-start checklist — it includes a shadow IT discovery section and incident response framework. No email required.

---

For the full audit template with risk scoring and remediation steps, check out the Ops Starter Kit — incident response templates, security checklists, and tabletop scenarios for small teams.