Four ways identity tools find shadow SaaS, and what each one misses

Discovery is the heaviest criterion in this site's reach score because you cannot govern what you have not found. Vendors describe several ways of finding applications. They are not interchangeable.

Route 1: sign-up and login monitoring

C1 describes monitoring shadow app sign-ups and logins to decide whether to bring an app under governance. The signal is a person creating an account or signing in to a service the organization has not connected. It catches SaaS adopted by teams, at the moment of adoption. It does not see applications that existed before monitoring started and are used quietly, or on-prem and custom systems.

Route 2: identity analytics

Lumos describes Identity Analytics that surfaces shadow IT alongside dormant and over-privileged accounts. Analytics work on data the platform already collects from its integrations, so they are strong at spotting patterns in connected sources and at linking shadow use to people.

Route 3: the browser

Push Security, which is not scored on this site, describes a browser extension for Chrome, Edge, Firefox and Safari that finds shadow SaaS and AI apps and hidden login paths that bypass SSO, without an endpoint agent. The browser sees what people actually sign in to, including personal-account sign-ups to work tools. It sees web applications used through managed browsers, and not service accounts or server-side integrations.

Route 4: discovery inside the estate

Orchid Security states that it discovers SaaS, cloud, on-prem, legacy and custom-built applications automatically, and maps how identity works inside them, including local accounts and hardcoded credentials. This route aims beyond what people sign in to through a browser, at applications and accounts on servers and inside custom code.

What about agents?

The same question now applies to AI agents. Okta describes agent discovery that surfaces unsanctioned (shadow) agents and registers them into a central directory, and C1 lists Shadow AI Discovery. Neither is scored on that basis here; the machine, service and agent accounts criterion uses what each scored vendor documents.

Which route do you need?

• If the main worry is teams signing up for SaaS, routes 1 to 3 see it as it happens.
• If the main worry is legacy, on-prem and custom applications and the local and service accounts inside them, route 4 is the one aimed at it.
• Most estates have both, so combine sources and count the result. The coverage gap calculator uses whatever total you arrive at.

The register records which parts of the estate each scored vendor documents, and the C1 and Lumos pairing compares two of the routes above directly.

Sources