I ran a shadow IT audit on myself last week.
I'm a one-person company. No employees. No portfolio. Just me, a laptop, and a business I started a few months ago. I figured the audit would be quick — maybe 20 accounts, mostly the obvious ones.
It found 86. With OAuth grants on more than 16 of them.
I used a tool called Nudge Security. You connect it to your Google or Microsoft Workspace account and it scans the OAuth permission grants and SSO logins your identity provider has issued. Anything that ever asked for access shows up. Including the things you forgot about an hour after you signed up (like that Fishbowl account from 5 years ago).
The list was humbling. A scheduling tool I tested for one meeting and never used again. Three different website design services. A lead prospecting app I tried once and abandoned. A training academy I decided wasn’t for me. Each one with a permission grant — some read-only, some with full read/write/delete access to my email — sitting there indefinitely.
Eighty-six accounts. Sixteen-plus active OAuth grants. One person.
Now do the math on a portfolio company. A 50-person SaaS company isn't running 50 times my number — productivity tools concentrate, so call it 600–900 accounts and several hundred OAuth grants. A 15-company portfolio is in the thousands of unmanaged identity surfaces. Nobody at the PE firm knows the count. Nobody at the portco knows the count. The portco's IT lead can name the sanctioned tools. The unsanctioned ones are invisible until something goes wrong.
This is the documentation problem in its purest form. The controls aren't missing — most of these tools are reputable, the OAuth grants are scoped, the security is fine. What's missing is the list. A defensible answer to "what has access to your data, who granted it, and when did you last review it." When an enterprise prospect asks during procurement, when a cyber insurer asks at renewal, when an auditor asks during SOC 2 — that's the question. And portfolio companies almost never have the list.
The audit on your company could take an afternoon and you can run a micro version of it this week:
Inventory. Connect a discovery tool (Nudge Security gives you a two week free trial, or your IDP's built-in OAuth report) to your primary identity provider. Pull the list.
Review OAuth grants. Sort by permission scope. Anything with write access to email, files, or calendar gets reviewed first. Revoke what you don't recognize or no longer use.
Purge dormant accounts. Anything you haven't logged into in 90 days is a candidate for deletion. Especially trial accounts.
Document what's left. A simple register: tool name, owner, data accessed, last reviewed. That's the artifact. That's the answer to the auditor's question.
Steps 1–3 are housekeeping. Step 4 is what turns it from a chore into a control.
I'll say it again because it's the whole thesis: this is a documentation problem, not a technology problem. The tools to find shadow IT exist. The tools to revoke access exist. What doesn't exist, in most portfolio companies, is the discipline of running the audit and remediating based upon the result.
If you're an operating partner, here's the version of this exercise to deploy across your portfolio: ask each portco CTO to run a shadow IT discovery scan and produce a one-page summary — total accounts, OAuth grants by risk tier, accounts revoked, accounts retained. Give them two weeks. The answers will tell you which portcos have any operational discipline around identity, and which ones are running on hope.
— Sierra