Companies maintain internal databases for sensitive information. However, sometimes employees want to take work home or believe it is easier to save files on their systems.

These seemingly minor and understandable oversights introduce a new and growing threat to all industries: Shadow Data. Typical security protocols do not address these scenarios, leading to unexpected gaps and increased risk of breach.

A New Kind of Insider Risk

As organizations accelerate cloud adoption and introduce dozens of SaaS applications, the digital landscape becomes more challenging to manage. Information is lost, misplaced, or thrown out without following proper procedures.

Chief Information Security Officers (CISOs) build their careers on spotting dangerous insiders, but this concept has quietly evolved. The disgruntled employee is no longer the most likely insider culprit.

Instead, it is the continuous buildup of sensitive data in unforeseen places like legacy SaaS applications, unreturned employee devices, and over-shared documents.

A CISO can’t see human behavioral cues or patterns that point to this buildup. Shadow Data threats do not require intent. They are the result of too many tools and too little governance, and addressing them requires tailored solutions.

Defining Shadow Data in the SaaS Era

Shadow IT refers to the use of unauthorized applications or systems outside of an organization’s IT infrastructure. For example, someone saving technical documents to their personal Dropbox or Google Drive accounts is using Shadow IT.

Shadow Data covers all the information kept and shared through these unofficial services or is otherwise outside the organization’s infrastructure. It is significantly easier to inform employees to stop using Shadow IT than it is to scrub everyone’s storage for sensitive data.

The primary places Shadow Data appears include the following:

• Developmental environments containing old versions of unprotected code
• SaaS copies on personal devices
• Legacy systems that are no longer monitored or protected
• Decommissioned AI tools that learned using organizational data

These potential weaknesses exist in all organizations and result from collaboration, experimentation, and rushed decisions. The risk only grows as the company hires more people, introducing new opportunities to create Shadow Data. 

Why Shadow Data Is a Risk Multiplier

Shadow data isn’t a standalone danger. It is strengthened by everyday tasks and actions taken within an organization.

Bypasses Traditional Controls

Most security tools protect aspects like endpoints, networks, or perimeter security. However, Shadow Data’s risks do not come from these environments and occur naturally throughout the day as employees share information or services are dropped.

The lack of a malicious pattern means that traditional controls cannot detect Shadow Data propagation. CISOs must employ strategies tailored to prevent shadow data from spreading across unregulated cloud services.

Can Survive Offboarding

Identity and Access Management (IAM) is one of the most essential cybersecurity measures an organization employs. It ensures that people only have access to the required information to perform their roles, minimizing the risks of a data breach by proliferating data at all levels.

However, IAM is not only relevant to existing employees. Offboarded team members must have their privileges revoked, or the organization loses all control over the data stored by that person. It is easy for a company utilizing dozens of SaaS programs to forget to remove access to one or two, particularly in a complex restructuring.

Some surveys report that nearly 90 percent of employees retain access to key platforms like Salesforce, PayPal, and QuickBooks after leaving a company.

Proliferates Silently

Shadow Data is not emotionally or situationally motivated, and there are few obvious outward signs of its spread. The SaaS sprawl causes many employees to duplicate files for convenience, whether to maintain personal copies or share with others.

• Exporting CSVs
• Sharing info with AI assistants
• Cloning PDFs

These are minor tasks performed for any number of reasons and aren’t reported to the CISO or any security officer.

Invites Compliance Violations

Compliance frameworks require organizations to maintain and protect strict records. Sharing or cloning records related to these frameworks obscures where personal or regulated data is stored, access privileges, and protections.

These factors make it significantly more challenging to understand whether the organization as a whole complies. Worst of all, there are dozens of compliance frameworks to keep track of, such as HIPAA, GDPR, and SOC 2, which affect various departments.

For example, many healthcare professionals deal with AI when ordering from vendors. They submit patient information into the prompts, potentially breaking HIPAA compliance in the process.

Why CISOs Often Miss It

Most CISOs understand that the security landscape is rapidly shifting. However, they also underestimate just how wide their data surface has become. The issue is not that CISOs aren’t adapting, but that they aren’t tackling the right problems.

Legacy Tools Lack Visibility in SaaS and Multi-Cloud Settings

Traditional security tools rely on endpoint checks, pattern recognition, and file signatures. These solutions aren’t built to scale with growing SaaS and Cloud infrastructure, in which users and files are moved off the server.

The National Health Institute has addressed these issues regarding Shadow Health Records. Healthcare professionals sharing patient information or transitioning to new infrastructure may create duplicate health documents that violate HIPAA compliance. 

Shadow AI and App Adoption Outpace Governance

The adoption of AI assistants and tools has introduced a more natural way for people to share insider information. Programs like ChatGPT save prompts to refine their knowledge base and understanding.

Employees using AI to research, ask questions, or record information may unwittingly submit sensitive data to an outside location. There is also no way to retrieve or delete the submitted data.

Additionally, organizations are under tremendous pressure to integrate new technologies rapidly to stay competitive. This leads to an increasing number of software programs that IT can’t control. The average business utilizes 379 SaaS programs throughout its operations, and IT teams cannot create and implement sufficient protocols to prevent the creation of Shadow Data.

How to Detect and Minimize Exposure

Shadow Data is an almost inevitable result of growth. More employees and new software are pivotal to scaling operations, so the solution is not to limit those aspects. Instead, CISOs must find ways to detect and eliminate exposure to Shadow Data without hindering users.

Implement DSPM and SSPM Solutions

Data and SaaS Security Posture Management are methods to address shadow data on the cloud and third-party services, respectively.

DSPM tools continuously scan cloud environments, such as on-premise servers, Amazon Web Services, Microsoft Azure, and web storage providers, for the organization’s assets. The found data is assigned a risk rating based on factors like confidentiality and access privileges.

Harmful instances are sent to security and threat management teams for remediation. However, many DSPM tools include automated methods for dealing with shadow data.

SSPM focuses on monitoring SaaS platforms to ensure preset configurations are maintained and users adhere to proper standards. It learns whether users changed settings, such as allowing a platform to export documents unauthorized. It can also reverse access permissions and other changes that could result in shadow data.

Together, these tools form the foundation for discovering and governing shadow data.

Build a Full Data Inventory

A foundational step to protecting assets is knowing where everything is. A full data inventory creates a dynamic inventory of an organization’s data that automatically updates itself based on configuration changes, sanctioned SaaS platforms, cloud storage buckets, internal servers, and AI datasets.

Run Risk-Based Access Reviews

Traditional access reviews treat all data the same. This wastes resources on checking no-risk areas and users with almost no access. It is more productive to review based on the asset’s likelihood of causing an adverse cybersecurity event.

These reviews can sniff out over-permissioned users and former employees who were not thoroughly offboarded.

Discover Shadow Apps

Organizations commonly discard existing communication, finance, or management platforms in favor of newer, shinier models. This phenomenon of an increasing library of services leads to SaaS sprawl, and many discarded services contain large amounts of Shadow Data.

In some cases, HR does not remove employees’ permissions with these shadow applications because they are not currently in use. A SaaS Security Posture Management Tool can scan the environment to find and remove these applications and users.

Real-Time Activity Monitoring

A somewhat controversial method of controlling Shadow Data is to understand how users transfer information. Dynamic SaaS environments require users to move files between platforms, often creating duplicate copies.

CISOs can use real-time monitoring to track whether these file transfers are suspicious. Factors like unusual access times, bulk file downloads, or repeated AI prompting can point to shadow data creation. This method is important with high-risk users or when using third-party platforms with reduced control.

Automate Remediation

Remediating Shadow Data is a monumental task. One document can have dozens or hundreds of people with access permissions, and the file could be hidden in a lockbox of .zip folders.

Automated remediation, like bulk unsharing, allows an organization to keep up with the massive volume and velocity of shadow data growth. It is critical to reduce exposure and enforce policy.

A Visibility Problem, Not a People Problem

Employees have long been called the weakest link in cybersecurity. While this is true in some cases, Shadow Data is largely a result of scaling operations and an increasingly cloud-reliant environment.

This threat isn’t manufactured out of malice, but by efficient employees doing their jobs. It is not their fault that governance protocols aren’t capable of keeping up with application adoption.

CISOs must expand their strategies to protect endpoint devices and secure users while understanding the data itself. They must learn that securing data requires a robust mix of real-time monitoring and automation to understand how data moves, who moves it, and whether that movement is safe.