To Map Shadow IT, Follow Citizen Developers

This commentary explores how shadow IT proliferates as employees adopt unapproved SaaS and low/no-code tools to meet business needs, often bypassing traditional controls and creating hidden data flows. It argues that embracing citizen development can help security teams discover and map critical shadow IT by following automations and integrations into sanctioned systems, while cautioning that these practices introduce security risks that must be managed.