[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Human Cyber Risk](/category/human-cyber-risk) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [The Shadow Supply Chain: A Pivot To Usage-Based Discovery](/blog/the-pivot-to-usage-based-discovery) Publish date July 2, 2026 {x} minute read # The Shadow Supply Chain: A Pivot To Usage-Based Discovery [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/user-risk-supply-chain) [Free trial](/demo) Written by [Shane Moosa](/team/shane-moosa) Content Writer Shane is a cyber writer with a software development background. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents Report The Shadow Supply Chain Free resource ### The Shadow Supply Chain [Download now](/resources/user-risk-supply-chain) We’ve established the new forensic reality: a massive 72.9% inventory gap exists between the vendors you monitor and those invisible to your security. We have seen the shortcomings of SSO and its inability to holistically monitor all the vendor applications your users engage with, along with a Shadow AI explosion that is compounding both issues. The era of procurement-only discovery is over. To secure the modern cyber workforce, we must pivot from "buying-based" to **usage-based discovery**. This method allows us not only to follow the purchase order and monitor SSO but also to supplement the parts they miss by [tracking browser telemetry](https://www.upguard.com/blog/closing-the-visibility-gap) to see what your users are actually engaging with on a day-to-day basis. With all three of these mechanisms working hand in hand—procurement to secure the vendor list we approve, SSO to secure the front door of applications users are engaging, and usage-based discovery via browsers to see what users are actually using daily—we can form a holistic approach to attaining and maintaining a record of your true vendor inventory. ## The 3 principles of usage-based discovery Usage-based discovery features, such as those provided by UpGuard’s User Risk, serves as a discovery engine which recognizes that usage—not a contract—provides a true indication of your vendor footprint. User Risk is built on this approach and, in practice, applies three core principles to ensure we provide your team with the accurate data they need to secure the vendors you approve and those lurking in the shadows. ### 1. Follow the user, not the money. Traditional discovery relies on purchase orders, but modern risk follows employee behavior. To close the inventory gap, organizations must deploy a dual-signal discovery model that combines identity logs with browser telemetry.  This is the only way to catch the 31.4% of vendor interactions that occur via direct browser access, bypassing OAuth or SAML logs entirely. By following the user's digital footprint rather than the procurement trail, you eliminate the blind spot where direct logins previously went unnoticed. ### 2. Monitor the "trusted." A common mistake in VRM is assuming that a corporate contract equals total visibility. Reputable vendors can still become "shadow tenants" that leak data through unmanaged, personal, or departmental instances. Consider that 90% of AI meeting assistants currently operate unmonitored, even within organizations that have established vendor governance. We see this pattern frequently: Zoom, for example, boasts an "Excellent" security score, yet our research found it was monitored in only 2 of the 13 organizations using it, leaving over 1,000 users unchecked on unmonitored instances. High-scoring vendors must be audited for shadow usage to ensure they aren't processing sensitive data on unvetted servers. ### 3. Tier by usage, not just scores. Security teams must stop tiering risk based on purchase orders and start tiering by real-world usage intensity. A "green" security score is a mirage if the vendor is being used in ways that bypass your security controls. True risk management requires a formula that incorporates both posture and the visibility gap: > *Risk = Security Posture x Exposure x Visibility Gap* This approach allows teams to prioritize risk based on actual employee behavior and the scale of unmonitored data exchange rather than static, trailing indicators like a signed contract. These three principles directly address the structural failures of traditional VRM in the modern user-led environment by replacing "assumed control" with forensic reality. Together, they transform your strategy from a reactive search for "[Shadow IT](https://www.upguard.com/blog/shadow-it)" into a proactive, usage-based governance model. ## The path to true vendor governance with User Risk By shifting to real-time usage data, you move beyond static spreadsheets. You can finally see the "Document Laundromats," "Invisible Employees" (AI bots), and all the smaller niche vendors operating in your environment. Once you have the true, unified visibility you need, you can predict risk factors more accurately, govern application and tool usage across high-risk areas, and report with confidence. UpGuard User Risk provides this unified visibility by consolidating disparate signals into a single view. This isn't just about finding more problems; it's about prioritization and action. By using our AI Analyst to synthesize thousands of signals into a **Unified Risk Score**, you can focus your team on the individuals and apps that pose the highest risk to the business. Beyond what usage-based discovery can provide in terms of visibility, it can also play a pivotal role in your overall security culture. When a user attempts to upload sensitive data to an unvetted AI tool, User Risk provides a real-time contextual nudge. We don’t just block them; we coach them in the moment of risk, building a security-first culture that scales. This allows you to leverage usage-based discovery as the engine not only for your vendor operations management but also for your individual employee security, cutting through the high demands of both governance and the users you need to protect and guide—all in one simple motion. > The UpGuard AI Security Center extends the approach of usage-based discovery to AI specifically. Our AI Insights help you understand the AI tools employees are likely using at a macro level, so you can guide adoption before it becomes an ungoverned pipeline.\ > \ > [Explore the AI Security Center →](https://www.upguard.com/solutions/ai-security) ## The future of user-centric risk management Ultimately, the 72.9% gap is a choice. You can continue to govern the 27.1% you can see, or you can embrace the reality of how your employees actually work. With usage-based discovery, you gain a true path to illuminate the shadows in your vendor inventory, empower your employees to make safe and responsible security decisions, and strengthen your overall cybersecurity posture. [**Read the full Shadow Supply Chain report here**](https://www.upguard.com/resources/user-risk-supply-chain?utm_campaign=2603-ur-ajs-misc-shadowsupplychain\&utm_source=website\&utm_medium=resource\&utm_content=blog-3-beyond-the-po)** **to get the complete picture.  Or, if you’re ready to see usage-based discovery in action, [**book a tour of UpGuard User Risk today.**](https://www.upguard.com/tour?utm_campaign=2603-ur-ajs-misc-shadowsupplychain\&utm_source=website\&utm_medium=resource\&utm_content=landing-page-product-tour-ur) Report The Shadow Supply Chain Free resource ### The Shadow Supply Chain [Download now](/resources/user-risk-supply-chain) ## Related posts Learn more about the latest issues in cybersecurity. Human Cyber Risk #### [Best Shadow AI Governance Tools for Enterprises: Buyer's Shortlist](/blog/best-shadow-ai-tools) Compare top shadow AI governance tools for enterprises, covering key capabilities and how to shortlist the right platform for your organization. [](/team/shane-moosa) [Shane Moosa](#) September 7, 2026 Human Cyber Risk #### [Human Risk Management Platforms: How to Choose the Right Software](/blog/best-human-risk-management-platforms) Protect your workforce with human risk management software that fits. Compare 10 platforms, the features that matter, and how to choose the right one. [](/team/shane-moosa) [Shane Moosa](#) August 31, 2026 Human Cyber Risk #### [AI Assurance: The Third Head of Your AI Governance Watchdog](/blog/ai-governance-to-ai-assurance) AI governance needs three things: policy, enforcement, and assurance. Most organizations have built the first two. Here's why the third one matters now. [](/team/shane-moosa) [Shane Moosa](#) September 21, 2026 Human Cyber Risk #### [How to Mitigate Human Risk in Cybersecurity: A Practical Framework](/blog/how-to-mitigate-human-risk) Security awareness training alone isn't human risk management. Use this seven-step framework to discover, govern, and coach workforce behavior. [](/team/shane-moosa) [Shane Moosa](#) August 25, 2026 Human Cyber Risk #### [Best AI Governance Platforms and Software (2026 Comparison)](/blog/best-ai-governance-platforms) Compare the top AI governance platforms of 2026 and find the right fit for your workforce and compliance needs. [](/team/shane-moosa) [Shane Moosa](#) August 10, 2026 Human Cyber Risk #### [The Architecture of an AI-Powered Breach: The Shadow Supply Chain](/blog/ai-powered-breach-and-the-shadow-supply-chain) Decode three real-world AI breaches. Learn how Shadow AI pipelines bypass security and how real-time browser guidance can stop data leaks. [](/team/shane-moosa) [Shane Moosa](#) July 6, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)