AI Is Expanding 'Shadow IT,' Not Consolidating SaaS
A 2026 benchmark report from SaaS management platform Torii finds that the proliferation of AI tools is accelerating SaaS sprawl within companies. The report concludes that AI is expanding shadow IT, with 61% of applications being unmanaged by central IT departments. This trend is reportedly increasing governance and security risks for enterprises.
- "Shadow IT" refers to any software, hardware, or IT resource used on a company network without the IT department's knowledge or approval. Common examples include using personal cloud storage like Google Drive for work files, or using unapproved messaging apps like WhatsApp for business communications. - The trend of "SaaS sprawl" is well-documented, with 51% of mid-market organizations reporting they have between 100 and 300 different SaaS tools in use. One 2025 survey found that 41% of companies are adding new SaaS tools every one to three weeks. - A primary motivation for employees to use unapproved software is to be more efficient or innovative when they find official tools to be too rigid or slow. However, this practice can lead to system inefficiencies and data silos, making it difficult to get a unified view of business operations. - Security vulnerabilities are a major risk of shadow IT, as unvetted applications can expand a company's attack surface and may lack proper data encryption or security patches. Data loss, leaks, and non-compliance with regulations like GDPR are also significant concerns. - Research firm Gartner predicted that by 2027, 75% of employees will acquire, modify, or create technology without IT oversight, a significant increase from 41% in 2022. - Financially, industry benchmarks suggest that companies overspend by an average of 25-30% annually on unused or underutilized software and cloud services. Some estimates place shadow IT spending at 30% to 40% of total IT spending in large enterprises. - The Torii report's methodology is based on real-world usage data from over 300 companies, not surveys. The company's platform is designed to discover all applications in use, including those not managed by IT, by analyzing signals from various sources like browsers, finance, and HR systems. - Before the recent surge in AI, a 2025 report already found that 15% of employees were routinely using unsanctioned generative AI tools on their corporate devices.
