The apps your clients never told you about.
The scenario:
Somewhere in your client base, a finance team is running its own file-sharing tool, a sales manager connected an AI notetaker to the CRM, and a director is on a personal Dropbox because the corporate one was slow that week.
Nobody asked you. Nothing announced itself. You are securing the estate you know while data flows through the one you do not.
The scale surprises people. Surveys of small businesses consistently find several times more SaaS in use than the IT provider knows about, because each tool arrived solving one person’s real problem on a company card. Every one of them holds company data, and none of them sit in your backup, your offboarding, or your incident plan.
The prompt:
You are building a shadow IT discovery process for an MSP.
Context: [your tooling, client mix, what visibility you have of SaaS sign-ins today]
Build:
The discovery sweep: OAuth grants review, expense-report keyword search, DNS and firewall log sampling, and the one-question staff survey clients will answer honestly
The triage: sanction, migrate, or block, with the criteria for each
The client conversation: presenting findings without blame, priced options where a shadow tool becomes a managed one
The standing control: the quarterly sweep and the new-app request route staff use because it is faster than going around it