Identity & Visibility · Discovery Checklist

Shadow IT & SaaS Discovery Checklist

Uncover hidden exfiltration vectors where unsanctioned tools commonly reside—including browser extensions, personal email forwarding rules, and free-tier cloud signups.

Walk through these operational inspection zones to identify hidden data leaks, unvetted AI tools, and shadow SaaS applications operating outside IT oversight.

Discovery Progress 0 of 7 vectors inspected (0%)

Vector Zone 1: Browsers & Extensions

Browser Extension & Web Clipper Audit

Inspect managed endpoints for unauthorized third-party browser extensions with document-scraping or clipboard-reading permissions.

Owner: Endpoint Security Unsanctioned AI / LLM Extension Check

Identify browser plugins designed to inject generative AI assistants directly into corporate web apps or email clients.

Owner: Web Gateway / CASB

Vector Zone 2: Email Routing & Forwarding

External Inbox Forwarding Rule Audit

Scan Microsoft 365 and Google Workspace environments for hidden inbox rules or transport rules forwarding company mail externally.

Owner: Email Security Operations Connected Accounts & Delegated Access Check

Review mailbox delegation permissions and consumer email account synchronization links active on employee accounts.

Owner: Identity Team

Vector Zone 3: Free-Tier SaaS & Cloud Storage

CASB DNS / Firewall Traffic Log Analysis

Query firewall and web proxy logs for outbound DNS requests pointing to unvetted file-sharing sites, pastebins, and cloud buckets.

Owner: Network Security OAuth Third-Party App Grant Review

Audit user-consented OAuth integrations connecting external productivity or calendar apps to core corporate Microsoft/Google tenants.

Owner: SaaS Security posture Corporate Credit Card & Expense Audit

Coordinate with Finance to review recurring expense reports for unapproved SaaS tool subscriptions expensed by departments.

Owner: IT Procurement & Finance

Discovery Tip: Run shadow IT discovery sweeps semi-annually or tie them into your broader insider risk mitigation strategy.

Subscribe to Updates

What's Hot