AI Expands Shadow IT, Not Consolidating SaaS
Contrary to expectations that AI would consolidate software stacks, it is instead accelerating SaaS sprawl, according to a new report from Torii. The 2026 benchmark report finds that 61% of applications are unmanaged as shadow IT, increasing governance and security risks for enterprises.
- The average enterprise now runs more than 830 applications, a number that jumps to 2,191 for large enterprises, according to the Torii report's analysis of real-world usage data. Of these, only 15.5% are formally sanctioned by IT departments, leaving the majority unmanaged. - This trend contradicts the narrative that AI would consolidate tech stacks by replacing specialized SaaS tools; instead, employee-led adoption of AI-native applications is accelerating the creation of unmanaged software. More than half of the most common shadow IT applications discovered are now AI-first tools. - "Shadow AI" refers to the unapproved use of generative AI tools by employees, such as feeding sensitive customer data into public-facing large language models (LLMs) for analysis or using unvetted AI plugins that connect to corporate data sources. - This practice introduces significant security risks, including the potential for sensitive data leakage through prompts, model poisoning attacks where training data is corrupted, and an expanded attack surface for phishing and malware. - From a governance perspective, unmanaged AI tools create compliance blind spots, as their usage can violate data protection regulations like GDPR and complicate data lineage tracking. - The financial impact of SaaS sprawl remains significant, with industry benchmarks indicating that organizations overspend by an average of 25-30% annually on unused or underutilized software licenses. Unofficial tools can also add a 40% increase to the mean time it takes to restore systems during an outage. - The proliferation of unmanaged AI is also creating "shadow code," where unaudited logic embedded within SaaS platforms by AI agents can execute tasks, modify data, and incur costs without traditional IT oversight.
