If your IT team is managing software purchases, they’re managing a shrinking share of the total. According to Zylo’s 2026 SaaS Management Index, IT directly controls approximately 15% of SaaS spend at the companies they track. Lines of business — department heads and team leads buying software directly — own most of the rest: roughly 81% of spend and 53% of application decisions. Shadow IT specifically, meaning software individual employees expense on their own with no procurement involvement, is a smaller slice of dollars (about 4% of spend) but a disproportionate share of the actual application count (34% of the portfolio) — lots of small, often-duplicative tools that never show up on a budget line.

This is not a failure of IT governance. It’s the structural outcome of a decade of software moving from enterprise procurement cycles to self-service credit card signups. What took six weeks of purchasing approval in 2015 takes six minutes in 2026. The tools got faster than the governance.

The problem is not that employees are buying software. The problem is that decentralized purchasing, without any coordination layer, produces predictable outcomes: duplicate tools, integration debt, security exposure, and a total cost of ownership that nobody has fully modeled.

What the Numbers Actually Show

Shadow IT statistics can be misleading because different sources measure different things. Some studies count applications (where shadow IT appears large because individuals download dozens of small tools). Others count spend (where shadow IT appears smaller because individual tools are cheaper than enterprise contracts).

The most useful data comes from Zylo’s purchasing analysis, which separates spend by procurement method. Their findings:

  • Lines of business directly own approximately 81% of SaaS spend and 53% of application decisions
  • IT directly controls roughly 15% of SaaS spend
  • Shadow IT via individual expense accounts is about 4% of spend but 34% of the total application portfolio — small dollar amounts per tool, but a lot of tools
  • Expense-based SaaS purchasing overall grew 267% year-over-year as AI tools became commonly expensed, with a single AI chat assistant now the most commonly expensed application at many companies

What this means for a 100-person company spending $500K annually on software: IT is actively managing around $75K of that. The other $425K is distributed across department heads, team leads, and individuals — some with procurement authority, some without, most without visibility into what the rest of the organization is buying.

The practical consequence shows up in three places: redundant spend (multiple teams independently licensing similar tools), integration sprawl (tools that each team chose without considering how they’d talk to each other), and security gaps (applications connected to company data without a security review).

Zylo’s license-utilization research shows the reverse framing is closer to reality: roughly half of paid SaaS licenses go unused or underutilized in a typical month, a pattern that has held across their last several annual indexes rather than a one-time anomaly. A significant portion of SaaS spend is paying for licenses that nobody is using, across tools that nobody has consolidated visibility into.

The Audit: What You’re Actually Looking For

Before building any governance process, you need to know what you’re dealing with. A shadow IT audit for a 50–300 person company has three data sources:

Expense report review. Pull twelve months of expense reports and filter for any recurring charges from software vendors. This catches subscription-based AI tools, productivity software, and specialized applications that employees are personally expensing. Pay attention to charges that appear every month from the same vendor — those are ongoing commitments, not one-time purchases.

AP and credit card data. Look at company credit card statements and accounts payable for SaaS vendor charges. Many shadow IT tools appear here when a department head or manager signs up with a company card without going through purchasing. Sort by vendor and look for duplicates — the same vendor appearing in multiple departments is a consolidation opportunity.

SSO and directory integration audit. If you’re running an identity provider (Okta, Azure AD, Google Workspace), pull the list of applications that are connected via SSO or OAuth. Any application that employees have authorized access to through single sign-on is consuming your identity infrastructure, even if IT didn’t select it. This is often the most complete picture of actual usage — tools that appear here are actively being used, not just paid for.

Cross-reference these three sources. Tools that appear in expense data but not SSO integration may be individual subscriptions. Tools in SSO but not in any budget line may be free-tier tools that employees upgraded to paid without formal approval.

Setting Guardrails That Work at SMB Scale

Enterprise shadow IT solutions are built for companies with dedicated IT procurement teams, legal departments, and vendor management offices. They don’t fit a 50–200 person company where the same person negotiating software contracts is also handling IT support and security reviews.

A workable governance model at SMB scale has three components:

A lightweight approval process for new tools. The goal is not zero-friction IT approval — that produces the shadow IT you’re trying to manage. The goal is making the approval process fast enough that department buyers prefer it to going around it. A simple intake form (What does the tool do? What data will it access? Who will use it? Is IT already paying for something similar?) with a 48-hour turnaround creates friction at the right point without becoming a blocker.

A small approved vendor list. Publish a list of pre-approved tools by category — project management, file sharing, communication, HR software, finance — that teams can adopt without a review. These have already passed your security and integration requirements. If a team wants to adopt something on the list, they just notify IT so it can be added to the license inventory. This removes the most common reason employees go around procurement: they need a tool quickly and the approved options are adequate.

An annual rationalization cycle. Once a year, pull the full inventory of everything the organization is paying for and compare it against actual usage data. For most companies, this is the moment they discover that three departments are paying for different project management tools, or that a security tool nobody uses anymore is still on auto-renew. The exercise takes a day and routinely surfaces five to ten percent of SaaS spend that can be consolidated or cancelled.

The AI Tool Problem

AI tools deserve specific attention because expense-based AI purchasing grew 267% year-over-year in the Zylo data, with ChatGPT now the single most commonly expensed application. Employees are buying AI tools faster than any approval process designed for traditional SaaS can handle.

The risk is not primarily cost — individual AI subscriptions are relatively inexpensive. The risk is data. Employees using consumer AI tools for work tasks are routinely entering customer data, financial information, and proprietary business logic into systems that were not vetted for data handling. Many consumer AI tools use user inputs to train future models by default unless users opt out. Most employees don’t know this.

A practical response: add AI tools as a specific category in your approval process, with a clear data-handling question as a required field. Before any AI tool gets added to the approved list, confirm how it handles user data, whether enterprise agreements are available with appropriate data handling terms, and whether it integrates with your existing identity infrastructure. This doesn’t stop employees from using AI — it creates a path for them to use it appropriately.

The underlying principle behind all of this: shadow IT is not an IT discipline problem. It’s an information problem. Employees buy tools outside IT channels because IT channels are slow, opaque, or don’t offer what they need. Faster approvals, better visibility into what’s already available, and a rationalization process that demonstrates the organization is managing software thoughtfully — these reduce shadow IT more reliably than policy enforcement, and they produce a software portfolio that actually serves the business.

Where Shadow IT Intersects With the Rest of Your Stack Decisions

A shadow IT audit and a full SaaS stack audit are really the same exercise run against different starting inventories — one starts from what IT already tracks, the other starts from what expense data, AP records, and SSO logs reveal that IT doesn’t. Run them together. A consolidation decision that only looks at the tools IT already knows about will miss the department-level duplication that’s usually the bigger source of waste.

AI tools deserve a second look inside this audit specifically because so many arrive through expense accounts rather than procurement. Before adding any AI tool to the approved-vendor list, run it through the same AI feature evaluation most stacks need anyway — a shadow AI tool that turns out to be feature theater isn’t worth the data-handling risk, however small the monthly charge looks. And because AI features increasingly price on consumption rather than seats, a tool an employee expensed at $20/month during a quiet pilot can scale to a very different number once a whole department starts routing real work through it — exactly the kind of cost surprise a lightweight approval process is designed to catch before it happens, not after.

Frequently Asked Questions

Is shadow IT primarily a cost problem or a security problem?

Both, but security is usually the bigger long-term risk. The direct cost of duplicate or unused licenses is real but bounded and easy to quantify. The security exposure — company data flowing into unvetted applications, some of which train models on user input by default — is harder to size and harder to unwind once it’s already happened.

How do we find shadow IT tools we don’t already know about?

Cross-reference three sources: twelve months of expense reports filtered for recurring vendor charges, company credit card and AP data sorted by vendor, and your SSO or identity provider’s list of connected applications. The SSO list is usually the most complete picture of what’s actually in active use, regardless of who approved it.

Won’t a formal approval process just push more purchasing underground?

Only if the process is slower than going around it. The goal isn’t zero-friction approval — it’s an approval process fast enough (a same-day or 48-hour turnaround) that department buyers prefer using it to bypassing it. A pre-approved vendor list for common categories removes most of the reason to go around procurement in the first place.

How often should we run a full software rationalization pass?

Annually is sufficient for most companies in the 50–300 employee range, timed to a budget cycle so consolidation decisions can take effect at renewal. The exercise typically takes about a day and routinely surfaces five to ten percent of total SaaS spend that can be cut or consolidated.

Are AI tools a special category within shadow IT, or just more of the same?

A special category, because the data risk differs in kind, not degree. A duplicate project management tool wastes money; a consumer AI tool an employee feeds customer data into may use that data to train future models by default. Treat AI tools as their own approval category with a mandatory data-handling question, not one more line in a SaaS review.