The State of Shadow IT in 2025: Mid-Market Report
Originally published in 2025, when SaaSVista focused on shadow SaaS discovery. Edited and republished in October 2026.
Ask an IT manager how many SaaS applications the company runs. You’ll get a number, and it’ll sound confident.
Then ask finance to pull every software charge off the corporate cards. Ask the identity team which apps have been granted access to company accounts. Ask a few department heads what their people open every morning.
You now have four different lists, and none of them match.
That gap is shadow IT. It isn’t a handful of rogue design tools. It’s a CRM somebody in sales signed up for, an AI assistant reading financial projections, a file-sharing app holding client documents. Nobody hid any of it. Nobody told IT either.
This is a practitioner’s view, not a data report. I’ve spent 30 years in IT security and infrastructure, and what follows is what I see when I look at how companies with a few hundred employees buy and use software.
Why Mid-Market Companies Are So Exposed
Small companies have shadow IT too, but everyone sits in one room and knows what everyone else uses. Large enterprises have procurement departments, security architects, and budget for tooling. The middle gets the worst of both.
Growth outpaces the IT team
Headcount can double in a couple of years. The IT team rarely does. The same few people who managed laptops and email for a small company now own identity, security, compliance, and a software footprint that grows every week. Governance is the thing that slips, because nothing breaks on the day you skip it.
Too big to ignore compliance, too small for enterprise tooling
Once you sell to larger customers, the security questionnaires arrive. Auditors start asking where customer data lives. You’re held to enterprise expectations with a budget that doesn’t cover enterprise products. So the question “what software do we actually run?” gets answered from memory.
Anyone with a card can buy software
Marketing buys a design tool. Sales buys a call recorder. Engineering picks up a new issue tracker. Each decision is reasonable on its own, and each team moves faster because of it. Nobody loops in IT because the purchase takes five minutes and IT review takes two weeks.
SSO feels like coverage
This is the one that catches experienced teams. If every app sits behind single sign-on, the SSO dashboard looks like an inventory. It isn’t. SSO shows you the apps somebody took the time to connect. It doesn’t show the ones people log into with a username and password, a “Sign in with Google” button, or a magic link in their inbox. Those are exactly the apps nobody reviewed.
Why the Usual Discovery Methods Fall Short
Most teams know they have a visibility problem. They try to fix it with one of three approaches, and each disappoints in its own way.
Manual audits. Somebody gets assigned to chase down expense reports, interview department heads, and build the list by hand. It takes weeks of work from people who already have full plates. By the time the list is finished, it’s out of date, because three new tools showed up while the audit ran.
CASB tools sized for enterprises. Cloud access security brokers do real work in large environments. They also assume a dedicated security team, a long rollout, and a budget to match. A mid-market IT team that buys one often ends up with a powerful product nobody has time to tune.
Spreadsheet surveys. Send every employee a form asking what they use. A fraction respond. The ones who respond list the obvious tools, the ones IT already knows. Nobody writes down the app they suspect they weren’t supposed to sign up for. You’ve measured willingness to fill out a form.
The common thread is that all three treat discovery as an event. Software adoption is a daily habit. A snapshot can’t keep up with it.
A Hypothetical That Should Feel Familiar
Picture this. A project lead at a services firm needs to share a client tracker with a contractor. The approved tool makes external sharing awkward, so she builds the tracker in a free database app and turns on a public link. It works. The project ships.
A year later she’s moved on to another company. The account still exists under her old work email. The public link still resolves. The client’s contact list and contract values are still in it.
Nobody did anything malicious. There’s no alert to fire, because no system the company monitors was ever involved. That’s what makes shadow IT hard. The risk comes from ordinary, well-meaning work.
How This Looks by Industry
The pattern is the same everywhere, but it shows up differently.
Technology companies have engineers who adopt developer tools quickly and quietly. The exposure here is source code and credentials ending up in personal accounts and unreviewed services.
Manufacturers tend to have lean IT teams focused on keeping production running. Office and shop-floor staff fill gaps with consumer-grade apps, and production data drifts into analytics tools nobody vetted.
Professional services firms live on client documents. The risk is confidential material spread across personal productivity and storage apps, outside any agreement the client signed.
Healthcare organizations carry the heaviest regulatory weight. A staff member pasting patient details into an unapproved app isn’t a tidiness issue. It’s a compliance problem.
The 2025 Trends Making It Harder
Four shifts are changing the shape of the problem this year.
AI tools
Every team is trying AI assistants, and most of that trial happens outside any approval process. People paste in contracts, customer records, and code because the tool is useful and the box is right there. Of everything on this list, this is the trend I’d watch most closely.
Browser-based apps
Nothing gets installed anymore. No installer means no endpoint software inventory, no admin prompt, and no ticket. An app can go from “never heard of it” to “the whole team depends on it” without touching a single system IT monitors.
Freemium
A free tier gets a tool in the door. Months later the team hits a limit and someone puts in a card. Now there’s a paid contract holding company data, and the first time IT hears about it is a line on an expense report.
App-to-app integrations
Unapproved apps rarely stay isolated. They ask for access to the calendar, the shared drive, the CRM. Each connection is a data flow nobody mapped. One unknown app with broad access to a known system is a bigger problem than ten unknown apps that touch nothing.
A 30-Day Action Plan
You don’t need a big program to get started. You need a month and some focus.
Days 1 to 7: Find what’s there
Pull the list of third-party apps granted access in your identity provider. Review card statements and expense reports for software charges. Ask each department head for the tools their team can’t work without. Merge it into one inventory and accept that it’s incomplete.
Days 8 to 14: Sort by risk
For each app, ask what data it holds and who can reach it. Customer data, financial data, source code, and regulated records go to the top. Flag anything with broad access to a core system.
Days 15 to 21: Take the easy wins
Cancel duplicates. Close accounts that belong to people who’ve left. Reclaim licenses nobody’s using. Move the highest-risk apps behind SSO or replace them with something approved.
Days 22 to 30: Make it stick
Write a short SaaS policy people will actually read. Set up a fast approval path, measured in days. Decide who owns the inventory and how often it gets refreshed. Tell employees what changed and why.
Three Habits of Good SaaS Governance
The plan gets you a baseline. These habits keep it from decaying.
Continuous discovery. A quarterly audit tells you what was true last quarter. Check for newly connected apps and new software charges on a regular rhythm, and treat a new app as a normal event to review instead of an incident.
Risk-based management. Not all shadow IT deserves the same response. An intern making a flyer in a design tool isn’t the same as an engineer pushing code to a personal repository. Spend your attention where the data is sensitive and let the low-risk stuff go.
Employee enablement. You won’t stop people from finding tools that help them work, and you shouldn’t want to. The goal is to make the approved path easier than the workaround. When the official option is good and the approval process is quick, most shadow IT fades without a fight.
The Bottom Line
Shadow IT in a mid-market company isn’t a sign that people are careless. It’s what happens when software is easy to buy and IT is stretched thin.
You can’t govern what you can’t see, so start with the inventory. Sort it by risk. Fix the obvious things. Then build the habit of looking again.
The AI trend this piece pointed at in 2025 turned out to be the big one, and it’s where SaaSVista’s work went. If that’s the part keeping you up at night, start with what AI governance actually means.
Mike Carroll
Founder & Field CTO at SaaSVista
30+ years in IT security and infrastructure. Previously CISSP certified, 2004-2022. Helping B2B SaaS startups prove AI governance readiness to enterprise buyers.
