I’ve had this conversation often enough that I can predict how it goes. Finance sends over a list of recurring card charges, and there’s a line item for a product nobody in IT has heard of.
It turns out someone in marketing signed up for it in the spring. They needed to do a job, the free tier didn’t cover it, the signup form took a card, and that was that. Six months later it’s a paid seat holding real customer data.
Nobody involved was trying to hide anything. The person just solved a problem at their desk, the way most of us would. I’ve noticed that this tends to happen in teams that move quickly and don’t have time to wait for a review cycle.
The part that gets me is how reasonable each individual decision looks when you hear it.
What it looks like day to day
Once you start looking, the pattern shows up in a few familiar shapes.
There’s the single-user tool that quietly became a team tool. One person signs up, invites four colleagues, and now five accounts sit outside your inventory with no owner named.
There’s the trial that never ended. A card was entered to unlock a feature, the trial period lapsed, and the charge kept running on a personal card someone is quietly expensing.
There’s the data question, which is usually the uncomfortable one. By the time you find the tool, it may already hold customer lists, contracts, or internal documents. Deleting it later means asking a team to give up something they rely on.
And there’s the leaving problem. If the account belongs to one person and that person moves on, the login often goes with them. I’ve seen a whole project’s files stranded in a tool nobody could get into.
There’s also the duplicate. I’ve found three separate subscriptions doing roughly the same job in three departments, each billed monthly, each convinced theirs was the only one. Nobody was wrong, they just never compared notes.
None of this is malicious. It’s just what happens when the easiest path to getting work done isn’t the one you’ve documented.
Why the signup button wins
I don’t think this is a discipline problem. It’s mostly about friction and timing.
Signing up takes two minutes and a card. Getting a tool reviewed can take weeks, and the answer might be no. When someone has a deadline on Friday, the comparison isn’t close.
Most approval processes also assume that software arrives through IT. These days it arrives through a browser. The request forms were built for a purchasing model that quietly stopped matching how people work.
Card policies make a difference too. If expense rules allow any recurring charge under a modest threshold, small subscriptions never get a second look. Individually they’re cheap enough to wave through.
There’s a social side. Teams talk to each other about what they use, so a tool that worked for one group spreads to another before anyone central hears about it. By then it’s baked into a workflow.
What some teams try
I’ve also seen unified platforms such as Ping64 used to cut down the overhead of juggling many separate security tools.
That’s one approach. Other teams put their effort into discovery first, using DNS logs, card feeds, or SSO records to work out what actually exists. I’ve seen both, and the discovery part tends to matter more than the platform choice. You can’t govern a list you don’t have.
Small things that help
- Ask finance for a quarterly list of recurring card charges, however small. It’s a surprisingly good inventory source.
- Make the approval path fast for low-risk tools. If the review takes a day, people tend to use it.
- Keep a short list of pre-approved categories so the common requests don’t need a discussion each time.
- Look at SSO logs for apps without an owner, then go ask. The conversation is usually friendly.
- When you find an unmanaged tool, decide whether to adopt it or replace it. Leaving it in limbo is the slow option.
- Ask what data a tool holds before deciding, not after. That question changes the answer fairly often.
These won’t stop people from signing up. They make it easier to find things early, while the decision is still small.
Wrapping up
People buying their own tools isn’t rebellion. It’s usually a sign that the internal path felt slower than the work required.
I’ve seen teams get better results from shortening that path than from tightening the rules. The goal isn’t to say no more often, it’s to hear about things sooner.
If you don’t know what your colleagues are signing up for, asking is a decent place to start.
Top comments (1)
the leaving problem is the one that stings, since the login walks out with the person. at a small team, is a shared owner mailbox on every signup enough, or does it still slip when someone is in a hurry?