Jun 09, 2025The Hacker News

A data breach can occur even without a rogue employee. All it takes is a forgotten free trial or an AI-powered note-taker syncing with your Google Drive without your knowledge. A personal Gmail account linked to a business-critical tool can also pose a significant risk. This is known as shadow IT, which encompasses not only unauthorized applications but also dormant accounts, unmanaged identities, over-privileged SaaS tools, and orphaned access. Most of these threats can evade even the most advanced security solutions.

Do you think your CASB or IdP can detect these threats? Unfortunately, they are not designed to catch what’s happening inside SaaS environments.

They are not equipped to identify OAuth sprawl, shadow admins, GenAI access, or apps created directly within platforms like Google Workspace or Slack. Shadow IT has evolved from a visibility issue to a full-blown attack surface.

Wing Security is a solution that helps security teams uncover these risks before they become incidents.

Here are five real-world examples of shadow IT that could be quietly putting your data at risk.

1. Invisible access that attackers can easily exploit

• The risk: Employees sign up for tools using only a username and password, without single sign-on (SSO) or centralized visibility. Over time, they stop using the apps, but the access remains, and worse, it becomes unmanaged.
• The impact: These zombie accounts turn into invisible entry points into your environment. You cannot enforce multi-factor authentication (MFA), monitor usage, or revoke access during offboarding.
• Example: In 2024, CISA and global cyber agencies issued a joint advisory warning that Russian state-sponsored group APT29 (part of the SVR) actively targets dormant accounts to gain access to enterprise and government systems. These accounts often serve as ideal footholds since they go unnoticed, lack MFA, and remain accessible long after they are no longer in use.

2. Generative AI secretly reading your emails, files, and strategy

• The risk: SaaS apps powered by Generative AI typically request broad OAuth permissions with full access to read inboxes, files, calendars, and chats.
• The impact: These SaaS apps often grant more access than required, exfiltrate sensitive data to third parties with unclear data retention and model training policies. Once access is granted, there is no way to monitor how your data is stored, who has access internally, or what happens if the vendor is breached or misconfigures access.
• Example: In 2024, DeepSeek accidentally exposed internal LLM training files containing sensitive data due to a misconfigured storage bucket, highlighting the risk of giving third-party GenAI tools broad access without oversight around data security.

3. Former employees still holding admin access, months after leaving

• The risk: When employees onboard new SaaS tools (especially outside your IdP), they often become the sole admin. Even after they leave the company, their access remains.
• The impact: These accounts can have persistent, privileged access to company tools, files, or environments, posing a long-term insider risk.
• Real-life example: A contractor set up a time-tracking app and linked it to the company’s HR system. Months after their contract ended, they still had admin access to employee logs.

4. Business-critical apps tied to personal accounts you don’t control

• The risk: Employees sometimes use their personal Gmail, Apple ID, or other unmanaged accounts to sign up for business apps like Figma, Notion, or even Google Drive.
• The impact: These accounts exist entirely outside of IT visibility. If they get compromised, you cannot revoke access or enforce security policies.
• Example: In the 2023 Okta customer support breach, hackers exploited a service account without MFA that had access to Okta’s support system. The account was active, unmonitored, and not tied to a specific person. Even companies with mature identity systems can miss these blind spots.

5. Shadow SaaS with app-to-app connectivity to your critical systems

• The risk: Employees connect unsanctioned SaaS apps directly to trusted platforms like Google Workspace, Salesforce, or Slack—without IT involvement or review. These app-to-app connections often request broad API access and stay active long after use.
• The impact: These integrations create hidden pathways into critical systems. If compromised, they can enable lateral movement, allowing attackers to pivot across apps, exfiltrate data, or maintain persistence without triggering traditional alerts.
• Example: A product manager connected a roadmap tool to Jira and Google Drive. The integration requested broad access but was forgotten after the project ended. When the vendor was later breached, attackers used the lingering connection to pull files from Drive and pivot into Jira, accessing internal credentials and escalation paths. This type of lateral movement was seen in the 2024 Microsoft breach by Midnight Blizzard, where attackers leveraged a legacy OAuth app with mailbox access to evade detection and maintain persistent access to internal systems.

What are you doing to address this issue?

Shadow IT is no longer just a governance problem—it’s a significant security gap. The longer it goes unnoticed, the bigger the risk and the more exposed your SaaS environment becomes.

Wing Security automatically discovers SaaS apps, users, and integrations—mapping human and non-human identities, permissions, and MFA status—without agents or proxies. Once the unknown becomes known, Wing delivers multi-layered SaaS security in one platform, unifying misconfigurations, identity threats, and SaaS risks into a single source of truth. By correlating events across apps and identities, Wing cuts through the noise, prioritizes what matters, and enables proactive, continuous security.

👉 Get a demo and take control of your SaaS environment – before hackers do.