Shadow IT Risk Calculator

Shadow IT risk assessment form

Unsanctioned apps discovered

Count found in browser, network, SSO, and expense data.

User adoption of unsanctioned tools (%)

Approximate percent of staff using at least one unsanctioned tool.

Data sensitivity handled

Higher sensitivity increases the impact of uncontrolled apps.

Compliance impact

Reflects regulatory exposure and audit scrutiny.

MFA coverage for business apps (%)

Higher coverage reduces account takeover risk.

Central logging coverage (%)

Percent of critical apps feeding audit logs into monitoring.

DLP / endpoint control coverage (%)

Coverage for data classification, blocking, and endpoint controls.

Average vendor risk

Use your questionnaire results or best estimate.

Shadow tool incidents (last 12 months)

Include data leaks, phishing via SaaS, or risky OAuth apps.

Governance maturity

Higher maturity reduces bypass behavior and unmanaged sprawl.

Egress controls coverage (%)

DNS filtering, secure web gateway, and allow/deny categories.

Discovery cadence (days)

Days between reviews/scans for new tools and OAuth apps.

Reset

This tool provides a structured estimate, not a replacement for a formal security assessment.

Example data table

Scenario	Apps	Adoption %	MFA %	Logging %	Cadence (days)	Typical result
Early visibility program	12	8	85	75	14	Moderate
High-growth team sprawl	95	42	55	40	45	High
Regulated data exposure	60	28	60	35	60	Critical

These are illustrative examples. Use your organization’s measurements for accurate scoring.

Formula used

Each input is converted into a risk factor on a 0–100 scale, where higher values mean more risk. Risk factors are then combined using a weighted average:

Risk Score = Σ ( Weight_i × RiskFactor_i ) ÷ 100

Weights reflect the relative importance of each dimension and sum to 100.
Control inputs (MFA, logging, DLP, egress) are inverted into “gaps” (100 − coverage).
App inventory exposure uses log scaling so extreme counts do not dominate.
Risk levels: Low (<25), Moderate (25–49.9), High (50–74.9), Critical (≥75).

How to use this calculator

Gather numbers from discovery sources: SSO logs, DNS/proxy, endpoint telemetry, and expense reports.
Estimate adoption percentage using surveys, identity logs, or agent data.
Choose sensitivity and compliance impact based on the most sensitive data used.
Enter coverage values for MFA, logging, DLP/endpoint controls, and egress controls.
Set discovery cadence to your current review frequency in days.
Click Calculate risk. Review the top drivers, then export CSV/PDF for tracking.

Shadow application growth signals

Shadow tools rise during remote work, rapid hiring, and tight deadlines. Track apps discovered per 100 employees: under 10 suggests strong intake, 20–60 indicates active sprawl, and above 60 often signals unchecked purchasing. Pair counts with adoption. Five percent adoption is containable, but 25% usually means core workflows moved outside approved platforms.

Risk score interpretation

The score blends exposure and control gaps on a 0–100 scale. Low reflects good visibility and limited bypass pressure. Moderate points to scattered use with mostly noncritical data. High appears when sensitive data meets weak monitoring, raising chances of takeover, misconfiguration, or oversharing. Critical is common when regulated data is used and discovery runs monthly or slower.

Visibility and discovery metrics

Better discovery comes from combining identity logs, DNS or web logs, endpoint inventories, and expense data. Identity events highlight new OAuth grants and unknown tenants. Network telemetry surfaces new domains, while endpoints reveal sync clients. A 7–14 day cadence catches new tools early. Beyond 60 days, blind spots grow, especially near quarter-end purchasing. Include periodic staff surveys to validate adoption estimates across departments.

Control coverage benchmarks

Measure coverage by applications, not users. Many teams target 90% MFA for critical apps and 75% for the long tail. Logging should capture admin actions, authentication, and file sharing. DLP works best with clear data classes, starting with customer identifiers and credentials. Egress controls reduce exfiltration by blocking unknown storage and risky categories on unmanaged devices.

Prioritization and remediation workflow

Use the top drivers to pick the fastest wins. If adoption is high, provide a sanctioned alternative and a migration checklist. If sensitivity is high, tighten sharing defaults and require vendor intake for affected apps. If monitoring is weak, stream SaaS audit logs into detection and alert on new admin roles. A 30-day sprint should reduce the biggest driver by 10 points.

Reporting and continuous improvement

Export results to maintain an audit trail. Report the score, the top three contributors, and the next controls to close. Recalculate monthly and after major shifts like mergers or policy changes. A drop of 5–15 points per quarter is realistic when approvals are fast and alternatives are visible. If the score stalls, simplify governance to reduce bypass incentives.

FAQs

What counts as shadow IT in this assessment?

Any business tool used without formal approval, including SaaS subscriptions, browser extensions, AI assistants, personal cloud storage, or unmanaged collaboration spaces that handle company data or credentials.

How can I estimate adoption percentage accurately?

Combine identity logs, proxy or DNS telemetry, endpoint inventories, and expense records. Validate with a short survey for teams with limited telemetry. Use unique active users over 30 days divided by total employees.

Why does the calculator invert control coverage into gaps?

Controls reduce risk when they are present. Converting coverage into a gap makes every factor comparable on the same 0–100 risk scale, where higher values consistently represent worse conditions.

How often should I recalculate the score?

Monthly is a practical standard. Recalculate sooner after major changes, such as new security policies, mergers, large hiring waves, or rollout of MFA, logging pipelines, or egress controls.

Which remediation step usually delivers the fastest reduction?

Improve discovery cadence and visibility first, then expand MFA and centralized logging for the apps that handle sensitive data. These actions reduce exposure quickly and create evidence for governance decisions.

Can I use the exports for audits or leadership reporting?

Yes. Export the breakdown, top drivers, and recommendations. Attach supporting evidence like discovery reports and control coverage metrics. Track month-over-month changes to show risk reduction and accountability.