1. Shadow IT is a governance gap
Shadow IT is technology adopted or used outside an organisation's established approval, procurement or management processes. It can include a paid team subscription, a free file-sharing service or an individually created account. An unfamiliar application is not automatically unauthorised: its approval record may simply be missing.
The operational problem is uncertainty. Teams may not know who owns the service, what information it holds, who can access it or which commitment will renew. Addressing that uncertainty requires investigation and ownership, not merely a longer list of detected names.
- Define what requires approval and distinguish unknown, approved, restricted and under-review applications.
2. Understand the need behind the tool
Employees often adopt tools because approved options lack a needed feature, purchasing takes too long or collaboration with a customer requires another service. Duplicate applications can emerge when departments solve similar problems independently or retain tools after a merger or team change.
A purely punitive response can discourage disclosure and leave the underlying need unresolved. Ask what work the tool enables, why an approved option was unsuitable and whether a supported alternative can genuinely meet the requirement.
- Provide a clear route for declaring tools and requesting assessment.
- Group applications by business purpose before labelling them duplicates.
3. Assess security, privacy and cost separately
An unmanaged service may hold business information without agreed access controls, recovery arrangements or an accountable owner. Privacy concerns depend on the personal data involved, its purpose and the relevant processing arrangements. Cost concerns include duplicate subscriptions, unclear billing ownership and commitments that survive an employee's departure.
These dimensions do not always move together. A free tool can create significant information risk, while an expensive duplicate may be justified by a specialist requirement. Prioritise by data sensitivity, access exposure, business dependency and contractual uncertainty rather than price alone.
- Escalate sensitive-data questions to the appropriate privacy or security reviewer.
4. Discover lawfully and proportionately
Start with permitted sources such as procurement records, invoices, approved identity data and employee declarations. Agree the purpose and minimum necessary information before adding collection methods. Where employee information is involved, involve privacy, legal and employee representatives as appropriate to local requirements.
Application discovery should not become unrestricted employee monitoring. Establish authorisation, transparency, access restrictions and appropriate retention before collection. A transaction or domain reference is a lead to validate, not conclusive proof of business use or individual misconduct.
- Document each source's coverage and blind spots.
- Do not collect message contents or unrelated personal activity merely to expand an application inventory.
5. Build a baseline that preserves uncertainty
For each application, record its name, purpose, owner, approval status, known data categories, evidence source and last review date. Keep unresolved fields explicitly unknown. Reconcile naming variations carefully so that separate services are not accidentally merged.
In a fictional example, finance imports a survey-service invoice, while a team manually declares its purpose. A matching email domain suggests a relationship, but that link remains inferred. The team lead then verifies ownership and business use. Whether former employees still have accounts remains unknown until checked with the service.
- Keep imported, manually entered, inferred and verified information distinguishable.
- Assign an owner and next review action to unresolved records.
6. Use Lojycal to support review, not claim omniscience
Lojycal can bring application-related inventory, licence, procurement and employee context into connected operational records. Available discovery signals and actions depend on configured sources, provider permissions, mappings and plan or role requirements. Confirm these for your workspace; Lojycal should not be assumed to detect every application or inspect every network connection.
Evaluate a bounded baseline first. Sample known services, compare available records with owner confirmations and identify what remains invisible. Then agree review routes for approval, consolidation or further investigation, with human assessment before consequential changes.
- Use /contact to confirm relevant sources and supported actions.
- Judge success by resolved ownership and better decisions, not the raw number of applications listed.