DField SolutionsMérnöki stúdió · Budapest
Loading · Töltődik
Skip to content
Back to glossaryTERM

Shadow IT

Related service Cybersecurity

DEFINITION

Shadow IT is any software, SaaS subscription, AI tool, browser extension, browser script, or automation that staff brought into the company without IT or security knowing, to make their own work easier. It is not malicious, just fast: marketing puts the launch doc in Notion, sales uses Apollo instead of the CRM, an engineer pastes source code into ChatGPT for debugging, customer success schedules with Calendly. Concrete SaaS-sprawl risks: 1) regulated data (PII, customer financials, source code) ends up on a third-party server with no DPA and no DPIA. 2) When an employee leaves, their SSO account is revoked, but the shadow tool they signed up for with their personal Gmail stays. 3) A SOC 2 or NIS2 audit cannot close with an unknown SaaS list. Fix: SaaS discovery (Torii, Productiv, or Workspace and Entra logs) plus a fast, simple approval flow (slow approval gets bypassed) plus a catalogue of pre-approved alternatives.

RELATED TERMS06
  • Threat model→

    A structured exercise that walks the system's actors, attack surface, risks, and controls. Day one of every DField project · before any code.

  • Penetration test (pentest)→

    Manual + tooled attack simulation that reveals what an attacker could achieve. We deliver findings as PRs in your repo, not an 80-page PDF.

  • DevSecOps→

    Security as a continuously-running CI step (SAST, DAST, SCA, IaC scan), not an annual project. Runs against every push; every sprint closes at least one security bug.

  • MFA (Multi-factor auth)→

    Two or more factors (TOTP, WebAuthn, biometric) beyond a password. Table-stakes in SaaS today · enterprise procurement disqualifies you without it.

  • SOC 2→

    A US audit framework for confidentiality, integrity, availability, and privacy controls. For SaaS, the Type II audit (6–12 months of observation) is the standard enterprise baseline.

  • ISO 27001→

    International standard for Information Security Management Systems (ISMS). Often preferred in Europe instead of or alongside SOC 2. 3-year certification cycle.

MENTIONED IN THE BLOG08