[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Human Cyber Risk](/category/human-cyber-risk) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [The Shadow Supply Chain: A 72.9% Gap In Your Vendor Inventory](/blog/the-gap-in-your-vendor-inventory) Publish date July 2, 2026 {x} minute read # The Shadow Supply Chain: A 72.9% Gap In Your Vendor Inventory [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/user-risk-supply-chain) [Free trial](/demo) Written by [Shane Moosa](/team/shane-moosa) Content Writer Shane is a cyber writer with a software development background. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents Report The Shadow Supply Chain Free resource ### The Shadow Supply Chain [Download now](/resources/user-risk-supply-chain) When an employee bypasses an "approved" tool for a frictionless, web-based alternative, they aren’t just being productive—they are effectively "hiring" a new vendor outside the scope of security governance. Multiply this across an entire enterprise, and you no longer have a few rogue apps; you have a shadow supply chain. Our latest research report, *The Shadow Supply Chain*, reveals how this hidden ecosystem is driven by user behavior and [accelerated by Shadow AI](https://www.upguard.com/blog/uncovering-the-shadow-ai-paradox). Moreover, our report revealed an almost haunting reality: the average security team is currently blind to 72.9% of its active vendor supply chain, a massive inventory gap that renders every compliance certification you hold technically inaccurate.  In this first installment of a three-part series, we explore the inventory gap in more detail: the distance between the list of vendors security teams think they have and what is actually happening on the ground. We’ll explore how this gap forms and why it's time to stop looking at what we *intended* to buy and start looking at what our employees are *actually* using. ## The inventory gap in traditional VRM (Intent vs. Reality) [Traditional Vendor Risk Management (VRM)](https://www.upguard.com/blog/vendor-tiering-why-tier-vendors) is built on a foundation of "Intent"—the purchase order, the contract, and the legal review. But in a world driven by product-led growth, modern infrastructure is built on behavior—specifically, user behavior. To quantify the gap between this intended control and operational reality, we analyzed anonymized telemetry from 20 security-conscious organizations, covering 3,470 application usage records and over 1,400 unique vendors. Of those applications we scanned, 2,531 instances were operating completely unmonitored, a 72.9% gap between what is being monitored and what’s being used on the ground. The data from this forensic analysis is clear: the real vendor inventory is 8x larger than what appears on the official "approved" list. Users can now engage vendors with a single click, often sharing sensitive corporate information with unauthorized tools. This results in a "shadow supply chain" of vendors you simply cannot see—and what you cannot see, you cannot govern. This isn't a failure of diligence by your procurement team or a failure of detection by your Security Operations Center (SOC); it is a structural failure of legacy tools designed for a pre-SaaS era. When a user can sign up for a tool in seconds, "Intent" becomes a trailing indicator that arrives months after the risk has already been introduced. ## The behavior-driven supply chain We often frame [Shadow IT](https://www.upguard.com/blog/shadow-it) usage as negligent, but the reality is much more nuanced: people are simply trying to do their jobs. However, in attempts at doing their job faster and more efficiently, the modern enterprise’s supply chain is no longer driven by centralized procurement—it is driven by individual employee behavior. So, how has the user become the primary architect of the hidden supply chain? It typically boils down to three human-centric factors: * **Convenience:** If a task takes five minutes but the "approved" tool requires a thirty-minute login process or a formal ticket, users will find the path of least resistance. * **Productivity:** Modern work moves at a pace that traditional procurement cannot match. To meet a deadline, a team will adopt a specialized tool today and worry about the contract later. * **The Tooling Gap:** Often, company-approved tools are too difficult to use or don't exist for specific niche tasks, forcing employees to find their own alternatives. These aren't one-off visits; these interactions happen daily. Our report outlines how this usage has become so deeply ingrained in core workflows that it has created a new vendor landscape that is completely invisible to the security team. ## The 3 risk architectures of the modern user When users interact with unapproved applications, they are effectively engaging a new vendor entirely outside the scope of security. This usage typically falls into three distinct "risk architectures" that drive the hidden supply chain: ***Note:**** The data below is cited directly from The Shadow Supply Chain report.* ### 1. Personal Document Editing * **The Behavior:** Employees are increasingly bypassing corporate tools in favor of browser-based PDF or file editors using their personal credentials. * **The "Shadow" Impact:** Tools like DocHub see an average of 229 unmonitored users per organization. This results in sensitive company data being processed on unvetted, third-party servers outside of IT control. ### 2. Departmental Project Management * **The behavior:** To maintain agility and speed, entire teams are migrating their workflows to external agile platforms. * **The "shadow" impact:** Platforms such as Notion or Smartsheet (averaging 196 unmonitored users) lead to the creation of "shadow tenants." These hubs of departmental knowledge remain completely invisible to risk management teams. ### 3. Engineering & Technical Diagramming * **The behavior:** Technical teams often turn to free, web-based tools to visualize complex systems and workflows. * **The "shadow" impact:** Use of tools like Diagrams.net (averaging 112 unmonitored users) is particularly risky, as these diagrams frequently contain sensitive network topologies and proprietary data flow architectures. The "shadow" impact isn't just about the number of users; it's about the sensitivity of the data—from internal network maps to unvetted document processing—moving beyond the organization's defensive perimeter. ## The path beyond shortlists When 73% of your supply chain is invisible, your incident response is decoupled from reality. You are effectively hunting threats in only a quarter of the forest. Because users are now the driving force behind your true supply chain, following a shortlist of "approved" vendors means you are missing both the scale of your exposure and the risks that lie dormant in unmonitored tools. We need a new governance model that follows the user, not the purchase order. > That 72.9% gap is driven by user behavior and accelerated by Shadow AI. The UpGuard AI Security Center helps reduce that gap with AI Insights that build your team's understanding of the AI tools and vendors your workforce is actually using, so governance starts from reality, not a purchase list.\ > \ > [Explore the AI Security Center →](https://www.upguard.com/solutions/ai-security) Be sure to stick around for our next blog, where we dive into why SSO fails to address this gap and how Shadow AI is worsening the problem. [**Or, Read the full Shadow Supply Chain report here**](https://www.upguard.com/resources/user-risk-supply-chain?utm_campaign=2603-ur-ajs-misc-shadowsupplychain\&utm_source=website\&utm_medium=resource\&utm_content=blog-post-1-the-invisible-73%) to see how UpGuard User Risk enables governance over this hidden supply chain through usage-based discovery. Report The Shadow Supply Chain Free resource ### The Shadow Supply Chain [Download now](/resources/user-risk-supply-chain) ## Related posts Learn more about the latest issues in cybersecurity. Human Cyber Risk #### [How User Risk Finds the Shadow AI Outside Your Directory](/blog/find-shadow-ai-outside-your-directory) Your directory shows the AI tools you approved. Here’s how User Risk finds the ones in your browsers that it doesn’t, before an auditor asks. [](/team/shane-moosa) [Shane Moosa](#) October 29, 2026 Human Cyber Risk #### [Best Shadow AI Governance Tools for Enterprises: Buyer's Shortlist](/blog/best-shadow-ai-tools) Compare top shadow AI governance tools for enterprises, covering key capabilities and how to shortlist the right platform for your organization. [](/team/shane-moosa) [Shane Moosa](#) September 7, 2026 Human Cyber Risk #### [Human Risk Management Platforms: How to Choose the Right Software](/blog/best-human-risk-management-platforms) Protect your workforce with human risk management software that fits. Compare 10 platforms, the features that matter, and how to choose the right one. [](/team/shane-moosa) [Shane Moosa](#) August 31, 2026 Human Cyber Risk #### [AI Assurance: The Third Head of Your AI Governance Watchdog](/blog/ai-governance-to-ai-assurance) AI governance needs three things: policy, enforcement, and assurance. Most organizations have built the first two. Here's why the third one matters now. [](/team/shane-moosa) [Shane Moosa](#) October 29, 2026 Human Cyber Risk #### [How to Mitigate Human Risk in Cybersecurity: A Practical Framework](/blog/how-to-mitigate-human-risk) Security awareness training alone isn't human risk management. Use this seven-step framework to discover, govern, and coach workforce behavior. [](/team/shane-moosa) [Shane Moosa](#) August 25, 2026 Human Cyber Risk #### [Best AI Governance Platforms and Software (2026 Comparison)](/blog/best-ai-governance-platforms) Compare the top AI governance platforms of 2026 and find the right fit for your workforce and compliance needs. [](/team/shane-moosa) [Shane Moosa](#) August 10, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)