Skip to main content
All articles
Security tips

· 7 min read · Kimetai Engineering

Shadow automations: the inventory problem nobody owns

Shadow IT used to mean an unapproved SaaS subscription. The modern version is worse: not a tool someone bought, but a process someone built — running unattended, holding credentials, writing into production systems, and appearing in no register.

Where they hide

Almost never in a repository. They live inside the platforms business teams already have licences for, which is precisely why they never reach a review board.

  • 01 · Orchestration

    n8n, Make, Zapier, Power Automate: a scheduled scenario built in an afternoon, with an API key pasted into a node, still running two years later.

  • 02 · Inside business apps

    Salesforce flows, Zoho workflows, HubSpot sequences, SharePoint rules. Configuration, not code — so nobody treats them as software.

  • 03 · Model calls

    A personal API key against a model provider, wired into a spreadsheet or a scheduled script. Cheap enough not to appear on any procurement radar.

Why the business built them — and why that is not the villain

Low-code delivered exactly what it promised: a marketing team that no longer waits two quarters for a queue in IT. That autonomy is a genuine win, and a governance policy that tries to reverse it will lose — quietly, in the form of automations built somewhere you cannot see.

The goal is not to take the tools away. It is to make sure that what gets built is visible, owned and bounded.

The four questions a first scan answers

  • Which automations exist, on which platform, triggered by what?
  • Which systems do they read from, and which do they write into?
  • Whose credential are they using, and is that person still here?
  • Which of them touch personal data, invoicing records or money?

The first connection usually surfaces more operating automations than the CTO expected — and the ones that matter are rarely the sophisticated ones. They are the two-node workflow that replicates invoicing data into accounting, built by someone who left the company, with a credential nobody has rotated since.

And that is the uncomfortable part: none of the frameworks in force accept “we did not know it existed” as an answer. Art. 30 of the GDPR expects that processing activity in a register. NIS2 expects it in an asset inventory. DORA expects it in an ICT asset register. The duty does not wait for the discovery.