Shadow IT: Tiering the Unseen to Manage Vendor Risk

Another ping. And another.

Employees are urgently logging IT tickets, trying to figure out why their trusted SaaS writing assistant subscription has expired. Meanwhile, your InfoSec team is frantically looking through the avalanche of alerts across the network, scouring vendor policies, and digging into procurement records to determine exactly when the organization provisioned this SaaS tool.

Spoiler alert: The organization didn’t.

There were no malicious intentions behind signing up for the tool—it just kind of happened. A quick sign-in prompt, an urgent deadline, a sudden employee shuffle. It gets the job done and keeps the momentum going.

But for your InfoSec team, it’s an escalating compliance conundrum from the minute that tool touches customer PII, or sensitive information, as a Tier 1 Risk. And because it came through the back door, it currently has Tier 0 oversight. That’s Shadow IT.

In this blog, we take you through the invisible layer spreading across your attack surface. We explore how this human element of risk intersects with Vendor Risk and how a tiering framework can support—and be supported by User Risk discovery.

Out of control sprawl

SaaS sprawl is at an all-time high, and the data backs it up. Our Shadow Supply Chain report found that 72.9% of vendor instances (2,531 out of 3,470) are not formally overseen by IT. This means that for every tool your team has vetted and secured, there are nearly three more operating in the shadows, handling organizational data while the massive visibility gap keeps growing.

Forbes highlights that it now takes 26% longer to identify and contain incidents involving unmapped data flows. Breaches involving shadow IT are accelerating, and it’s a security crisis.

Read more on our comprehensive guide on what Shadow IT is and the risk it poses to your organization here>

Discovery and governance

To manage what you can’t see, you first need a logic for categorization. Without it, Shadow IT remains a persistent problem. A governance framework can act as a filter, allowing low-risk, high-utility tools to pass through quickly while flagging high-risk data processors for deeper investigation. 

Without this logic, infosec teams would treat every PDF compressor with the same weight as a core Customer Relationship Management (CRM) system. This leads to burnout and ultimately, security processes that exist just for the sake of having a process, rather than actually reducing risk.

The categorization disconnect

Vendor tiering is the specific approach required to bring clarity, but its effectiveness depends entirely on organizational maturity:

• For “zero” states: For organizations with no program in place, every new tool is essentially a manual fire drill.
• For “static” states: Many organizations have a basic framework that relies solely on static procurement intake processes. These forms are often outdated from the moment they’re signed, and they offer little to no real-world context. This leaves businesses unsure of where the actual risk lies.

The “ideal” state 

Sound logic and a clear methodology for categorizing risk drive effective tiering. This requires objective criteria (such as data sensitivity or network access) and the ability to perform manual overrides that move at the speed of the business, as we’ve established in our Vendor Tiering series, covering the fundamentals, the logic, and the implementation.

Building this from scratch can be a massive undertaking, which is why we’ve developed a resource to help you get started. Our Vendor Tiering Toolkit is designed to serve as your operational framework and includes an onboarding questionnaire example, pre-built templates, and logic to provide clarity and guidance to your infosec team.

Download the Vendor Tiering Toolkit here >

Identifying signals with User Risk

Most discovery methods rely on the network, either by tracking URLs or by blocking domains. But in a decentralized world, looking at a list of web addresses isn’t particularly helpful because it isn’t the full picture. To understand your exposure, you have to look at the human signal.

The moment an employee interacts with a new tool is significant because it signals intent. Identifying these signals early on allows infosec teams to see the intent behind the action, rather than just the traffic. This approach shifts the focus from intent-based records to usage-based discovery, analyzing the real-time behavior that precedes a security incident. Moving beyond simple URL tracking, it provides a forensic reality of the active vendors your team is already using.

Establishing usage-based discovery and intelligence 

By focusing on behavioral signals and pivoting to usage-based discovery (looking at what applications and vendors users are actually engaging with day-to-day), organizations can spot early indicators of Shadow IT before it infiltrates their organization. UpGuard’s User Risk monitors these signals to provide the true visibility and context you need: 

• Identify authentication: Detects when corporate credentials or single sign-on (SSO) are used to create accounts on unvetted platforms, signaling that a “personal” tool just became an organizational one.
• Data interactions: Monitors the movement of sensitive data or intellectual property into unauthorized models or productivity tools. 
• Browser telemetry: Captures real-time data on how employees interact with web applications directly within their browser. This provides a forensic view of active usage, surfacing direct login and unmonitored web-based tools that bypass traditional security.

Converting the unknowns into intelligence 

The process turns the unknown into a real-time inventory, surfacing tools that functionally act as Tier 1 vendors before they can cause a Tier 1 incident. 

By integrating UpGuard’s User Risk signals directly into your security workflow, you catch the $20 productivity hack before it becomes a multi-million dollar data leak.

Closing the loop with Vendor Risk

Discovery provides visibility, but without action that just turns into documentation. A list of unvetted tools serves as a record of potential liabilities, not a security strategy. 

To protect your organization, these initial signals must trigger a structured response. Effective risk management requires a seamless handoff where discovery data informs a long-term governance framework.

When a new tool enters the ecosystem, its lifecycle begins immediately. Governance ensures this lifecycle aligns with organizational security standards. This involves moving the tool out of the shadows and into a managed environment where its impact on data and infrastructure is fully understood.

Transitioning to automated governance 

UpGuard’s Vendor Risk automates the transition between identifying a tool and managing its risk. Once a tool is discovered, it shouldn't just sit on a static list. Instead, it enters a centralized Vendor Onboarding Portal, triggering an immediate justification request for the business owner. This makes certain that every application has a clearly defined business purpose.

Logic-driven tiering and management

Applying automated tiering logic to newly identified tools ensures they receive the appropriate level of scrutiny. For instance, if an app touches Personally Identifiable Information (PII) or intellectual property, it is instantly moved up to a high-criticality tier. 

Using automated Vendor Risk workflows ensures that apps in the shadows are identified, assessed, tiered, and managed with the same rigor as your most critical core infrastructure.

By centralizing these workflows, infosec teams maintain a living inventory that adapts to employee behavior. This proactive stance makes sure that no tool remains unmanaged, regardless of how it first entered your vendor ecosystem.

For a deeper understanding of our 5-tier model and methodology, download our Best-Practices Guide: Tiering and Classifying Vendors by Inherent Risk.

Mitigating Shadow IT with a unified approach

If the first time your team hears about a new vendor is through a troubleshooting ticket for an expired subscription, your risk management is inherently reactive. When discovery only happens after a tool is already integrated into a daily workflow, infosec teams end up playing catch-up rather than providing proactive guidance.

Modern risk management cannot survive on static “check-the-box” intakes. Connecting the behavioral signals with a structured categorization framework ensures that every application (whether officially sanctioned or lurking in the shadows) is identified, tiered, and governed.

This unified approach integrates real-time signals with categorical logic, resolving the blind spots that traditionally plague infosec teams. Tools are tiered the moment they are used, not months later when they’re flagged during a point-in-time assessment. High-risk data movements trigger immediate reviews, preventing unauthorized tools from becoming permanent fixtures. Lastly, by identifying and approving safe alternatives early on, infosec stays ahead of the risks of Shadow IT.

Your infosec teams can now move at the same speed as business, so that the next time an employee hits an urgent deadline, the tools they reach for are already approved.

Align your discovery with your defense. Synchronize real-time User Risk detection with automated Vendor Risk tiering to bring every application into your managed inventory.

‍