What is Shadow IT?

Shadow IT is technology that exists outside an organisation’s official asset inventory. In the context of attack surface management, shadow IT typically manifests as subdomains, cloud instances, and web applications deployed by teams to solve immediate problems - without going through formal security review or provisioning processes.

Why shadow IT exists

Shadow IT is a symptom of friction between the speed teams need to move and the pace of formal IT processes. When a developer needs a monitoring dashboard, waiting two weeks for provisioning is impractical - so they deploy Grafana on a cloud instance with a subdomain and move on.

This isn’t malicious. It’s rational behaviour under time pressure. But it creates assets that are invisible to security teams.

Shadow IT as an attack surface risk

Shadow IT assets are consistently the weakest points on an external attack surface:

• They miss security reviews, so they’re often misconfigured
• They miss patch cycles, so they accumulate vulnerabilities
• They miss monitoring, so compromises go undetected
• They often use default credentials or weak authentication

Discovery

EASM platforms like SurfaceLoop discover shadow IT by scanning from the outside - the same perspective an attacker has. Subdomain enumeration, certificate transparency log analysis, and port scanning reveal services that internal inventories miss.