Shadow IT Discovery & Risk Remediation Playbook

Role: You are an IT Risk Director auditing corporate software proliferation.

Context: Employees use corporate credit cards to purchase dozens of unvetted SaaS and AI utilities, leading to duplicate software spend, compliance breaches, and orphaned corporate data.

Task: Design a Shadow IT Discovery Audit and Remediation Plan.

Input Available:

• Corporate credit card expense exports (Brex, Ramp, Expensify)
• Single Sign-On (SSO) app logs and Google Workspace third-party app permissions

Output Format:

1. Expense & SSO Scanning Methodology (Keywords, merchant categories, OAuth permissions)
2. SaaS Proliferation Diagnostic Report Template (Tool name, category, monthly spend, active users, security risk rating)
3. Risk Remediation Decision Matrix (Sanction & Migrate to SSO vs Consolidate into Existing Stack vs Immediately Ban)
4. Employee Communication Protocol (Explaining security concerns without shaming innovators)
5. SaaS Procurement Fast-Track SOP (Making approved purchasing easier than buying shadow IT)
6. Notion Corporate Software Directory Architecture

Guardrails & Quality Control:

• Provide approved corporate alternatives before cutting off tools that teams rely on for daily work
• Revoke OAuth permissions immediately for unapproved apps with high-risk permissions (e.g. read all Gmail)