What is Shadow SaaS? Causes, Risks, and Management Tips

An executive asks about a cloud app you've never heard of, and a check turns up dozens more that nobody approved. Each one already holds company data, and you have to explain that risk to a budget holder in one sentence.

The gap between approved apps and what your workforce uses is often wider than your inventory shows. UpGuard's Shadow Supply Chain report found that across 20 organizations, security teams had no visibility into roughly 73% of active vendors.

This guide defines shadow SaaS, separates it from shadow IT, and gives you a four-step framework for treating each app as the vendor it is.

A definition of shadow SaaS

Shadow SaaS is the cloud software your employees adopt without IT approval or security review. The vendor behind each app now holds your company's data under terms nobody vetted. 

It includesfree-tier tools employees sign up for with a work email and subscriptions paid for with a corporate card. It also covers browser extensions and app-to-app integrations connected through OAuth, the open standard that lets one app act on your accounts in another.

Many of these apps bypass single sign-on (SSO), the login layer your identity provider (IdP) controls. When an employee signs up with a password or a personal account, the IdP never records the app, so your SSO-based inventory stays silent.

Procurement may log each app as a policy violation, but the security problem runs deeper. You have a vendor holding your data with no assessment or breach notification clause on file. That gap is why shadow SaaS belongs in your vendor risk program, with discovery as the starting point instead of the finish line.

Shadow SaaS vs shadow IT: what's the difference?

Shadow IT covers any unapproved technology, including personal devices, on-premises software, and cloud services. Shadow SaaS is the cloud-application subset where the vendor stores or processes your data. As a result, every shadow SaaS app is an unapproved data-sharing event with a third party your team has never assessed.

Practitioners often ask whether shadow SaaS is just shadow IT with a new name. The two overlap, yet the controls differ because the risk sits on a vendor's infrastructure instead of your network. You can't patch or wipe a SaaS app. Instead, you tier it by usage, assess the vendor to the depth the tier requires, and revoke its access when needed.

What security risks come from unmanaged SaaS application usage?

Unmanaged SaaS usage creates four main security risks. The first two are OAuth scope over-grant and data exfiltration through unapproved integrations. The other two are compliance exposure when apps process regulated data without a data processing agreement (DPA) and supply-chain exposure from unassessed vendors.

Here's how each risk shows up in your environment:

• OAuth scope over-grant: Users approve broad OAuth 2.0 scopes, the permissions that define what an app can reach, across mail and files. Those grants often stay active long after the business need has passed.
• Data exfiltration through unapproved integrations: Connected apps copy records out of sanctioned systems into vendor storage you can't audit or delete.
• Compliance exposure: Apps handling personally identifiable information, protected health information, or financial records without a DPA lack the processor contract GDPR Article 28 requires.
• Supply-chain exposure from unassessed vendors: A vendor breach becomes your incident, with no security assessment or notification clause on file.

Token abuse at a connected app can spread far past one company. Cloud Security Alliance reports that the Salesloft Drift OAuth token theft in August 2025 affected more than 700 organizations. 

The exposure worsens when no one on your team knows the app exists. You can't revoke a token you never knew about, and you can't ask a vendor you've never assessed for incident details.

How do enterprises detect and manage shadow SaaS?

Mature programs detect and manage shadow SaaS in four steps, each driven by a specific signal or tool:

1. Discover: Find apps outside your sanctioned inventory through SSO gap analysis,  cloud access security broker (CASB), and SaaS API logs.
2. Engage: Contact the business owner and active users to confirm the app's purpose and the data it touches.
3. Prioritize: Rank apps by usage signals such as active users, the sensitivity of the data they touch, and granted OAuth scopes.
4. Respond: Use an intake trigger to onboard the app under your vendor onboarding policy, or an offboarding trigger to revoke tokens and block it.

Discovery starts with SSO blind spots, because your IdP only sees apps connected to it. Zylo found that, in the average organization, only 21% of applications sit behind SSO, according to its 2026 SaaS Management Index of customer data. Password sign-ups and trial accounts leave no trace in your IdP.

You close that gap by correlating CASB traffic logs and SaaS API audit logs with your IdP records. A CASB sits between users and cloud services. The UK National Cyber Security Centre describes its purpose as identifying which cloud services your users access. Any domain that shows up in traffic or OAuth grant logs without a matching IdP entry goes on your shadow SaaS list.

That list feeds the asset inventory the NIST CSF 2.0 Identify function expects, where ID.AM-04 calls for inventories of services suppliers provide. CIS Controls Control 2 applies the same discipline to software assets and asks you to address unauthorized software once you find it.

Prioritize and Respond are where shadow SaaS turns into vendor risk work. An app with dozens of active users and OAuth access to your file storage needs a vendor risk tier and an assessment. A single-user note-taking tool might only need a policy reminder.

See how Vendor Risk turns discovered apps into assessed vendors.

How do you manage shadow SaaS risk in a multi-cloud environment?

Managing shadow SaaS across multiple clouds means repeating discovery in every environment. Run SSO gap checks per cloud tenant, correlate CASB and API logs across cloud accounts, and keep a sanctioned versus unsanctioned app inventory per environment. Single-tenant discovery misses apps connected inside tenants that aren't linked to your primary SSO.

Each cloud provider keeps its own record of connected apps, so check these identity sources tenant by tenant:

• Microsoft Entra ID: Lists enterprise applications and the consent grants users approved in each tenant.
• AWS IAM Identity Center: Lets admins assign users and groups to configured applications, so it shows only apps someone has already connected.
• Google Workspace admin console: Lists apps that have accessed Google data in your domain, with user counts and the OAuth scopes each one requests.

On Google Cloud, marketplace purchases can draw down existing cloud commitments, so SaaS spend can land on the cloud bill instead of a separate vendor invoice. Pull marketplace billing records into the same inventory so those subscriptions get the same review.

Where UpGuard fits into shadow SaaS

Discovery tells you which apps exist, and the next job is turning them into managed vendors. Two UpGuard products cover that handoff:

• Vendor Risk: Uncovers every vendor, declared or discovered, and brings each one into a structured onboarding flow.
• User Risk: Detects SaaS and AI apps in use, including logins outside SSO. It then cross-references each new shadow SaaS app with Vendor Risk.

Once an app surfaces, you can onboard it as a vendor and send a security questionnaire from the same platform. Shadow SaaS follows the same vendor risk management lifecycle as your contracted vendors, starting with discovery and onboarding, then moving into assessment and continuous monitoring.

Take a Vendor Risk tour to see the discovery and onboarding workflow in the UpGuard platform.

Frequently asked questions

Is shadow SaaS the same as shadow AI?

Largely, yes. Shadow AI refers to AI tools used without approval, and most of them are SaaS apps. The same vendor logic applies, because every prompt pasted into an unapproved AI tool shares data with an unvetted third party.

Why doesn't SSO catch shadow SaaS?

SSO only logs apps connected to your IdP. Employees who sign up with a password or a personal account bypass it, so the app never appears in your SSO reports.

Is ChatGPT considered SaaS?

Yes, ChatGPT is a hosted AI application delivered as a service. OpenAI's enterprise data commitments cover its business products, so work done in personal accounts falls outside the terms your company negotiated.

Should you block shadow SaaS apps outright?

Usually not. The UK National Cyber Security Centre advises against unnecessary lockdowns because staff turn to insecure workarounds when approved tools don't meet their needs. A fast intake path that approves low-risk apps and assesses high-risk ones usually works better.