> ## Documentation Index > Fetch the complete documentation index at: https://docs.leveragecyber.io/llms.txt > Use this file to discover all available pages before exploring further. # Shadow IT Discovery: Unauthorized and Forgotten Assets > How Leverage Cyber uncovers unauthorized SaaS apps, forgotten cloud instances, and employee-created assets operating outside your security controls. Shadow IT grows faster than most organizations realize. A marketing team adopts a new analytics platform using a corporate credit card. A developer spins up an EC2 instance for a proof of concept and forgets to terminate it. A sales engineer creates a shared Dropbox folder to exchange files with a prospect, then leaves the company. None of these assets appear in your IT asset inventory. None are covered by your access management policies, your patch management process, or your incident response plan. Every one of them is discoverable by an attacker using the same public data sources Leverage Cyber uses — and every one is a potential breach entry point that your security team cannot see. ## What Shadow IT Looks Like Applications adopted by business units without IT approval — CRMs, project management tools, collaboration platforms, and marketing services — that authenticate with corporate email addresses and may store company data with no visibility into the vendor's security posture. Virtual machines, containers, and cloud functions provisioned for temporary projects, testing, or development work that were never decommissioned — often running outdated software with no patching, monitoring, or access controls. Dropbox, Google Drive, Box, and similar services used by employees to share company files with external parties, frequently with overly permissive link settings and no expiration, leaving sensitive content publicly accessible long after the original need has passed. Applications built years ago for specific business needs — internal portals, reporting tools, legacy ERPs — that were never formally retired and remain accessible from the public internet, often running end-of-life software with known, unpatched vulnerabilities. ## How Leverage Cyber Finds It Leverage Cyber identifies shadow IT entirely through passive reconnaissance — no agents, no network scanning, no credentialed access to your environment required. The discovery methodology includes: * **Passive DNS enumeration** — systematically mapping hostnames associated with your organization's IP ranges and domain portfolio to identify assets not present in known inventories * **SSL/TLS certificate transparency logs** — every certificate issued for a hostname is logged publicly; Leverage Cyber continuously monitors certificate transparency logs for new certificates containing your organization's domain names or naming conventions, which surfaces new cloud deployments and SaaS integrations in near-real time * **Internet-wide passive scan datasets** — Leverage Cyber correlates your known IP ranges and domain data against large-scale internet observation datasets to identify services running on non-standard ports, unexpected protocols, and cloud hosting providers not in your approved list * **Cloud asset correlation** — by analyzing naming patterns, metadata, and hosting provider data across discovered assets, Leverage Cyber identifies cloud resources likely provisioned by your organization even when they use non-obvious hostnames Every discovery step uses data that is already publicly available. If Leverage Cyber can find it, an attacker can find it. ## Common Shadow IT Findings Business teams frequently adopt SaaS tools that support "Sign in with Google" or "Sign in with Microsoft," enabling employees to authenticate with their corporate credentials without IT involvement. While SSO reduces password risk, it does not give IT visibility into what data is stored in the application, what the vendor's security controls are, or whether the application is properly offboarded when an employee leaves. These tools appear in Leverage Cyber's findings when corporate email addresses are associated with the platform through breach data, certificate records, or DNS patterns tied to SSO integrations. Development and testing environments are the most common category of shadow IT finding in enterprise environments. They are created for legitimate purposes, granted internet access for convenience, and then forgotten when a project moves to production or is cancelled. These environments routinely contain copies of production databases, hardcoded API keys, and debug interfaces that would never be exposed in a production context. Because they are not monitored or patched, they also frequently run software versions with known critical vulnerabilities. Public-facing cloud storage buckets — particularly on AWS S3 and Google Cloud Storage — created by individual employees are a recurring source of significant data exposure. Employees create buckets to share files externally, set permissions to public for convenience, and never revisit the configuration. Bucket names frequently include company names, project names, or department identifiers, making them trivially discoverable through both passive data sources and targeted enumeration. Acquisitions routinely leave behind standalone applications running on the acquired entity's infrastructure, authenticated against the acquired company's identity provider rather than the parent organization's. These applications fall outside the parent's access review cycles, meaning former employees of the acquired company may retain access indefinitely. They are also outside the parent's patch management program, leaving them exposed to vulnerabilities that the parent's own systems would have addressed. ## Why It Matters Every shadow IT asset represents a blind spot in three critical security functions. Your **access management** program cannot enforce least-privilege, offboarding, or MFA on accounts in systems it does not know exist. Your **patch management** program cannot address vulnerabilities in software it has not inventoried. And your **incident response** program cannot detect, contain, or investigate a breach that originates from an asset that is not in scope. The practical consequence is that shadow IT assets are disproportionately likely to be the entry point in a breach — not because they are more vulnerable than known systems, but because they receive none of the security attention that known systems do. An attacker conducting reconnaissance identifies them as soft targets specifically because they appear unmonitored. Shadow IT findings are correlated against breach exposure data as part of Leverage Cyber's cross-module analysis. When a shadow IT asset — such as an unsanctioned SaaS tool or a forgotten cloud portal — is matched against a breached credential for the same platform or service, the combined finding is elevated to high severity and surfaced immediately. A SaaS application your IT team does not know about, paired with a valid employee credential from a breach dump, represents an open door that requires same-day action.