There is a good chance your company is currently paying for software that your IT team does not know about. Someone in marketing signed up for a design tool on the company card. Someone in logistics found a route planning app on a forum. The operations manager subscribed to an AI assistant to help with weekly reports. All reasonable people solving real problems — and none of it went through any approval process.
This is shadow software. It is not usually malicious. Most of the time it is just practical: someone has a problem, they find a tool, they put in a card number, and they get on with their day. The risk is what happens after that.
How common is this
More common than most managers realize, and the numbers are from before the current wave of AI tools made it even easier.
According to Zylo's 2024 SaaS Management Index — a study covering over 30 million software licenses — 84% of SaaS applications in companies sit outside IT's direct oversight, purchased by business units or individual employees. The same research found that 65% of software bought on employee expense cards carries a poor or low security rating. These are not fringe tools. They are things people are using every day to do their jobs.
For smaller businesses, Capterra's 2023 research puts the picture in more concrete terms: 57% of small and mid-sized companies have significant shadow IT operating outside IT oversight, and the average SMB loses around $43,500 per year to untracked or unused SaaS subscriptions — tools that renewed automatically, were forgotten after a trial, or are still running for people who left the company months ago.
Those numbers are from 2023 and 2024. In 2026, when anyone with a laptop and a cloud account can build and sell a SaaS product in a weekend, the volume of available tools has only grown. The barrier to entry for becoming a software vendor is near zero. The barrier to buying that software is even lower.
Why it is a real business risk
The security and cost problems are real, but the one that tends to surprise managers most is the compliance exposure — specifically around data.
When an employee enters customer names, supplier contracts, employee records, or internal financial data into an unsanctioned tool, that data is now sitting somewhere you did not agree to, under legal and security terms you never reviewed. IBM's 2024 Cost of a Data Breach report found that 35% of data breaches involved data stored in unsanctioned systems, and that those breaches cost on average 16% more than breaches involving approved systems — likely because the unsanctioned tools are harder to detect, slower to audit, and not covered by any incident response plan.
Many smaller SaaS vendors — especially newer ones — store data on servers outside the EU without clearly disclosing this. Some have no data security certifications. Some allow vendor staff to access customer data for support purposes without audit logging. None of this is necessarily illegal on its own, but all of it becomes your problem when the data in question belongs to your customers or employees.
What procurement can do about it
Shadow software tends to be treated as an IT problem, but the entry point is almost always a purchase. Someone spent money. That is procurement territory — and procurement teams at mid-sized companies often have better visibility into spend patterns than IT does.
The starting point is visibility. A basic review of recurring charges on expense cards and departmental budgets — anything that looks like a monthly or annual SaaS subscription above a low threshold — gives you a working picture of what is actually running. Most finance teams can pull this data; the question is whether anyone has thought to look at it through a software lens.
From there, the goal is not to block tools people genuinely need. A slow or unclear approval process is what pushes people to bypass procurement in the first place. If getting a €20/month tool approved takes three weeks and three signatures, people will just put it on their card. A lightweight approval path — a short form, a defined turnaround, a checklist of the questions below — removes the friction without removing the control.
Five questions to ask before approving any software spend
Whether a tool comes through a new approval process or you are retroactively reviewing something already in use, these are the questions that matter.
1. Do you have a Data Processing Agreement, and will you sign ours?
Any legitimate SaaS vendor processing personal data on behalf of EU-based customers should have a standard DPA available and be willing to sign it. If a vendor cannot answer this question or does not know what a DPA is, that tells you something important about how seriously they take data governance.
2. Where is our data stored, and who has access to it?
You want a specific answer — country, cloud region, and a clear statement about whether vendor staff can access customer data and under what conditions. "We use AWS" is not sufficient. "We use AWS eu-west-1, data is encrypted at rest and in transit, and staff access requires a named engineer with audit logging" is a real answer.
3. Do you hold ISO 27001 or SOC 2 certification?
These are the main internationally recognized security certifications for software companies. ISO 27001 is more common in Europe; SOC 2 is the US standard. Neither guarantees perfect security, but both indicate that the vendor's practices have been independently reviewed. Ask to see the certificate, not a checkbox on their website.
4. How is our data deleted when we stop using the service?
Offboarding is frequently overlooked. You want to know whether data is deleted automatically, how quickly, and whether you can get written confirmation. Some vendors retain data for extended periods after contract end, or delete it only on request. This matters more when the data involves personal information covered by GDPR.
5. Is the product GDPR compliant, and how can you demonstrate it?
Any vendor serving European customers should be able to point you to their privacy policy, their DPA template, their sub-processor list (the third parties they share your data with), and ideally a compliance page or trust portal. "Yes, we're compliant" without supporting documentation is not a useful answer. Compliance is paperwork, not a feeling.
The procurement angle
Most procurement teams are set up to handle large software contracts — the ERP renewals, the enterprise agreements that land on the CFO's desk. The smaller SaaS spend lives in expense reports and departmental budgets, and it does not feel like a procurement problem until something goes wrong.
The teams that get ahead of this do not necessarily have better tools or bigger budgets. They have someone who looked at the expense data, asked the right questions, and built a simple process before the problem became a headline.
If you want to think through what that looks like for your organisation, I am happy to have that conversation at sourcing-sense.com.