Shadow IT: Reading the Demand Signal

Unsanctioned software isn't a discipline problem. It's your users telling you what IT failed to deliver. The instinct is to treat shadow IT as rebellion — something to be found, blocked, and punished. That instinct is why it keeps happening. This episode reframes unsanctioned technology as a demand signal. Every credit card SaaS subscription is a documented case of someone needing a capability badly enough to solve it themselves. The security exposure and license liability are real, and this episode does not soften them. But the durable fix isn't enforcement; it's service. Bill covers how to find what's actually running, how to triage it by risk rather than by annoyance, and how to build an intake path fast enough that going around IT stops being the rational choice. The measure of an ITAM program isn't how much it prevents. It's how little anyone needs to go around it. IN THIS EPISODE - Why shadow IT is a demand signal, not a discipline problem - Business units now control the overwhelming majority of SaaS spend — and what that means - Finding what's actually running: expense reports, SSO logs, network data, and their blind spots - Triage by risk, not by annoyance — a practical severity model - The real exposure: data residency, license liability, and orphaned admin accounts - AI-native tools entering through expense reports faster than governance can respond - Building an intake path fast enough that going around IT stops making sense - Why enforcement-first programs generate more shadow IT, not less - Service as the organizing principle — measuring how little anyone needs to route around you CHAPTERS (00:02) - Hunting Shadow IT (03:22) - Shadow IT Costs (06:31) - Shadow AI Rises (09:20) - Finding Hidden Tools (11:30) - What To Do Next (14:20) - Refresh Debate Next TRANSCRIPT Click here to view the episode transcript. SOURCES & FURTHER READING Zylo 2026 SaaS Management Index https://zylo.com/2026-saas-management-index Findings summary and methodology https://zylo.com/news/2026-saas-management-index Flexera 2026 State of ITAM Report https://www.flexera.com/blog/it-asset-management/state-of-itam-2026/ IBM Cost of a Data Breach Report https://www.ibm.com/reports/data-breach ABOUT THE SHOW Operational ITAM is a podcast about the unglamorous machinery of enterprise technology — hardware and software asset management, licensing, audit defense, SaaS governance, and the money quietly leaking out of all of them. Bill Van Nort has led IT asset management, end-user computing, IT operations, and workplace technology at large organizations across banking, mortgage, and automotive. He has reclaimed millions in software spend and survived audits from the biggest publishers on the planet. Consulting enquiries and listener case files: operationalitam.com