By Raúl Pérez · Last updated: October 2026 · Reading time: 12 min
Every large organization has two IT departments: the official one, and the unofficial one made of hundreds of employees who sign up for tools on their own because they need to get work done. Marketing buys a design platform with a corporate card. Sales installs a browser extension that syncs the CRM to a personal spreadsheet. A data team spins up a cloud account outside of procurement.
This is shadow IT, and its price tag is bigger than the subscription fees. In this guide you will learn what shadow IT really costs, a step-by-step method to calculate shadow IT costs in your enterprise, how to discover unsanctioned apps, and a practical program to reduce spend and risk without grinding the business to a halt.
What Is Shadow IT?
Shadow IT is any hardware, software or cloud service used within an organization without the explicit approval, knowledge or support of the IT or security department. In practice, the most common forms today are:
- Unsanctioned SaaS applications: project trackers, file sharing, AI chat tools, design and analytics products.
- Personal accounts used for work: personal cloud storage, messaging apps, email forwarding.
- Cloud infrastructure outside governance: accounts or subscriptions created by a team on a corporate card, bypassing central cloud management.
- Browser extensions and plugins with broad permissions to company data.
- Unapproved AI tools, where employees paste company data into public generative AI services.
- Third-party OAuth integrations that connect an unvetted app to Microsoft 365 or Google Workspace.
Not all shadow IT is malicious. Most of it appears because the official tools are slow, missing a feature or hard to get approved. That is important when you design the response.
Why Shadow IT Is Expensive: The Cost Components
The subscription fee is just the visible tip. A complete model includes the following categories.
1. Direct subscription and usage costs
What the organization actually pays: licenses, usage-based fees, cloud consumption. These are often scattered across expense reports, corporate cards and departmental budgets, so they are rarely totaled anywhere.
2. Duplicate and overlapping spend
If three departments each buy a different video platform, the organization pays three times for the same capability and gives up the chance to negotiate one enterprise deal.
3. Lost volume discounts
Separate small purchases are priced at list or near list. Consolidating them under a single enterprise agreement typically unlocks better rates and terms.
4. Security and breach exposure
Unvetted tools may lack encryption, SSO, audit logging or sound data handling. Each is a path for data leakage or compromised credentials. The expected cost of a breach is probability times impact, and impact in an enterprise can reach millions once investigation, notification, legal fees, downtime and reputational damage are included.
5. Compliance and legal risk
Personal data processed in unapproved tools may violate GDPR, HIPAA, PCI DSS or contractual commitments. Fines, audit findings and failed customer security reviews are real costs.
6. Integration and data fragmentation
Data scattered across unofficial tools is hard to find, reconcile and report on. Teams spend hours moving data between systems or arguing about which number is right.
7. Support and remediation effort
When shadow tools break, people ask IT for help anyway. IT then spends time on systems it does not know, cannot access and was never designed to support.
8. Offboarding and access leakage
When an employee leaves, access to unmanaged tools often persists, which is both a security risk and a cost if seats keep being billed.
9. Migration and cleanup costs
If a shadow tool becomes critical, moving it into the official stack later is an expensive project, often under time pressure.
How to Calculate Shadow IT Costs: A Step-by-Step Model
There is no single universal formula, so use a transparent model whose assumptions you can defend to finance and the board.
Step 1: Estimate the volume of shadow IT
Start with discovery (covered in the next section) to find the number of unsanctioned apps, users per app and cost per app. If you cannot discover everything, sample a few departments and extrapolate carefully, labeling it as an estimate.
Step 2: Calculate direct costs
Direct cost = sum over all shadow apps of (annual subscription + usage fees + related cloud costs)Step 3: Calculate duplication waste
Group apps by category. For every category with more than one tool, treat all but the cheapest (or best) as redundant:
Duplication waste = sum of cost of redundant tools in each categoryStep 4: Calculate the missed discount
Missed discount = total shadow spend that could be consolidated x expected negotiation discountUse a conservative discount such as 10 to 20 percent for consolidation, adjusted to your own history with vendors.
Step 5: Estimate risk-adjusted security and compliance cost
Risk cost = probability of an incident per year x average cost per incident x share attributable to unsanctioned toolsUse internal incident data or reputable industry reports for average incident cost, and be transparent that it is an expected value, not a certain loss. Include compliance costs, such as extra audit hours or fines you have already faced.
Step 6: Estimate productivity and support cost
Productivity cost = employees affected x hours lost per month x 12 x loaded hourly cost
Support cost = IT tickets related to shadow tools x average handling time x loaded hourly costStep 7: Add up
Total shadow IT cost = direct cost (only the waste portion, if comparing against savings)
+ duplication waste
+ missed discount
+ risk cost
+ productivity and support costA caution on presenting the number: do not double count. Direct costs of tools you will keep are not waste, even if they are unmanaged. Separate hard savings (cancelled spend), cost avoidance (risk reduction, discounts) and soft costs (productivity), because finance treats them differently.
Worked example (illustrative numbers)
A company with 5,000 employees discovers 180 unsanctioned apps.
| Component | Calculation | Annual cost |
|---|---|---|
| Direct subscriptions | 180 apps, average $6,000 | $1,080,000 |
| Duplication waste | 45 redundant tools x $5,000 | $225,000 |
| Missed volume discount | $855,000 consolidable x 15% | $128,250 |
| Risk cost | 5% annual probability x $4,000,000 x 30% attributable | $60,000 |
| Productivity and support | 400 affected staff x 2 hrs/month x 12 x $60 | $576,000 |
| Support tickets | 600 tickets x 1.5 hrs x $55 | $49,500 |
| Hard waste + avoidance + soft cost (excluding the tools kept) | about $1,038,750 |
The exact numbers will differ. The value of the exercise is that it turns a vague worry into a number, with assumptions people can challenge and refine.
A small script can keep the model reproducible:
def shadow_it_cost(apps, redundant_cost, consolidable_spend, discount=0.15,
incident_prob=0.05, incident_cost=4_000_000, attributable=0.3,
affected_staff=400, hours_per_month=2, hourly_cost=60,
tickets=600, ticket_hours=1.5, ticket_rate=55):
missed_discount = consolidable_spend * discount
risk = incident_prob * incident_cost * attributable
productivity = affected_staff * hours_per_month * 12 * hourly_cost
support = tickets * ticket_hours * ticket_rate
return {
"duplication": redundant_cost,
"missed_discount": missed_discount,
"risk": risk,
"productivity": productivity,
"support": support,
"total": redundant_cost + missed_discount + risk + productivity + support,
}
print(shadow_it_cost(apps=180, redundant_cost=225_000, consolidable_spend=855_000))How to Discover Shadow IT
No single method finds everything. Combine at least three.
- Identity provider and SSO logs. Google Workspace, Microsoft Entra ID, Okta and similar systems show which third-party apps employees sign in to and which OAuth permissions they granted. Review the list of consented applications and their scopes regularly.
- Finance and procurement data. Analyze expense reports, corporate card transactions and accounts payable for recurring software vendors outside the approved list.
- Network and DNS analysis. Secure web gateways, firewalls and DNS logs reveal traffic to SaaS domains.
- CASB or SSE tools. Cloud access security brokers and secure service edge platforms discover cloud app usage and can score risk.
- Endpoint and browser telemetry. Device management and browser extension inventories show installed apps and extensions.
- SaaS management platforms. These tools combine many sources into one inventory. See [Best SaaS Management Platforms (SMP) to Audit License Waste].
- Surveys and amnesty campaigns. Ask departments to declare the tools they use, with a promise of no punishment during an amnesty period. You will learn why people chose those tools, which is as valuable as the list itself.
An example of how to review OAuth app grants in Microsoft Entra ID with Microsoft Graph PowerShell:
Connect-MgGraph -Scopes "DelegatedPermissionGrant.Read.All","Application.Read.All"
Get-MgOauth2PermissionGrant -All |
Group-Object ClientId |
Sort-Object Count -Descending |
Select-Object -First 25 @{n="ClientId";e={$_.Name}}, CountCommand names, scopes and available data differ by tenant and module version, so test in a safe environment and check the Microsoft Graph documentation. Google Workspace admins can review third-party app access in the Admin console under the API controls section.
How to Reduce Shadow IT Costs and Risk
Banning everything does not work. People find a way around blocks, and you end up with less visibility. The goal is to make the official path the easiest path, and to manage what remains.
1. Classify what you find
For each discovered app, decide one of four outcomes:
| Decision | When to use | Action |
|---|---|---|
| Sanction | Useful, secure, reasonable cost | Onboard formally, add SSO, assign an owner |
| Consolidate | Overlaps with an approved tool | Migrate users, set a sunset date |
| Restrict | Useful but risky | Limit data, require extra controls or approvals |
| Block or retire | High risk or no value | Block access and remove after data export |
Prioritize by risk and spend: apps handling customer or regulated data, apps with broad OAuth permissions, and apps with the highest cost.
2. Create a fast, friendly approval path
The main reason people go around IT is that approval takes too long. Publish a catalog of approved tools by category, set a service level (for example, a decision within 3 business days) and provide a simple request form. Pre-approve low-risk tools and categories.
3. Offer good approved alternatives
Ask teams what they were trying to do. If a team adopted a tool because the standard one lacks a feature, either fix the standard tool or approve the better one. Replacing a hated tool with another one people dislike just moves the shadow elsewhere.
4. Centralize procurement and payment
Route software purchases through procurement or a central card system with virtual cards per subscription. Block unapproved software categories on corporate cards where feasible. Consolidate vendors and negotiate enterprise agreements. See [Enterprise Software Negotiation Tactics to Lower Annual Renewal Costs].
5. Enforce identity and access controls
- Require SSO and MFA for all business-critical apps.
- Restrict users from consenting to third-party OAuth apps without admin approval, using an admin consent workflow.
- Review and revoke risky or unused OAuth grants periodically.
- Automate onboarding and offboarding so that access follows HR events.
6. Use technical controls where they add value
- Apply CASB, secure web gateway or DLP policies to block or monitor high-risk categories and prevent sensitive data from being uploaded to unsanctioned services.
- Set up alerts for new, previously unseen apps with broad permissions.
- For generative AI, publish a policy, provide an approved enterprise AI tool and monitor use of public alternatives.
7. Bring cloud infrastructure under governance
Shadow IT is not only SaaS. Use cloud management tools, organizational policies and billing alerts to detect cloud accounts or subscriptions created outside governance. Enforce tagging, budgets and landing zones. Our cloud cost guides cover this in detail, for example [Azure Cost Management: Ultimate Guide for DevOps Engineers].
8. Educate and communicate
People rarely understand the risks of unapproved tools. Short, concrete training with real examples of data leaks or compliance failures works better than policy documents. Explain how to request tools, and thank teams who surface what they use.
9. Measure and report
Track the following monthly or quarterly:
| Metric | Goal |
|---|---|
| Number of unsanctioned apps discovered | Trending down |
| Percentage of apps behind SSO | Trending up |
| Average approval time for new tools | Under 3 days |
| Spend on consolidated vs unmanaged vendors | Shift toward managed |
| High-risk apps with sensitive data | Zero |
| Realized savings from cancellations and consolidation | Reported to finance |
| Employee satisfaction with approved tools | Increasing |
A 90-Day Plan
Days 1 to 30: See
- Pull SSO, OAuth, finance and network data.
- Run an amnesty survey.
- Build the inventory and classify top apps by risk and cost.
Days 31 to 60: Decide
- Apply sanction, consolidate, restrict or block decisions to the top 30 apps.
- Launch the approval catalog and fast-track form.
- Turn on admin consent for OAuth apps.
Days 61 to 90: Act and measure
- Migrate users from duplicates and cancel contracts.
- Negotiate enterprise agreements for consolidated categories.
- Report hard savings, cost avoidance and risk reduction to leadership.
After that, run the discovery cycle quarterly.
Common Mistakes
- Starting with punishment. It drives shadow IT deeper underground.
- Treating all shadow IT as equal. Focus on high-risk, high-spend apps first.
- Ignoring why teams chose the tools. The cause is usually a gap in official tooling.
- Overstating the savings. Be conservative and separate hard from soft numbers.
- Buying tools before defining the process. Technology without governance rarely works.
- Forgetting shadow AI. Generative AI tools spread faster than any previous category.
Frequently Asked Questions
How much does shadow IT cost a typical enterprise? There is no reliable single figure. Costs depend on company size, industry and how much spend and risk sit outside governance. Build your own estimate using the model above rather than relying on generic statistics.
Is shadow IT always bad? No. It often signals unmet needs and can drive innovation. The problem is unmanaged risk and cost. A good program sanctions valuable tools instead of simply banning them.
What is the difference between shadow IT and shadow AI? Shadow AI is a subset in which employees use unapproved AI tools, often feeding in company data. It raises specific data protection and intellectual property concerns.
What tools help detect shadow IT? Identity providers, CASB and SSE platforms, network monitoring, finance data analysis and SaaS management platforms. Most organizations combine several.
How often should we review? Continuously for high-risk signals such as new OAuth grants, and quarterly for the full inventory and cost review.
Conclusion
Shadow IT costs more than the sum of its subscriptions. Duplicate tools, lost discounts, security and compliance exposure, and lost productivity all add up, and they can be estimated with a transparent model. Discover the apps through multiple sources, classify them by risk and value, make approval fast, centralize procurement and identity controls, and measure the results. Treat shadow IT as feedback on what your people need, and you will cut both cost and risk while keeping the business moving.