A Major Audit Firm Discovered All Its Shadow IT in Under 60 Days

Introduction

Audit firms handle sensitive data and face stringent compliance requirements. Shadow IT and Shadow AI pose major risks: undocumented usage, client data exposure, and difficulty demonstrating compliance. This case study shows how Avanoo enabled a major audit firm to discover its entire Shadow IT footprint in under 60 days, across an environment of more than 15,000 users.

Context

The firm had partial visibility into its application landscape: approximately 200 officially known and managed applications. But the true scale of usage remained unknown. Three critical challenges drove the initiative:

• Lack of visibility: No way to know which applications were actually being used, by whom, or for what purpose.
• High non-compliance risk: In a sector where compliance is central, any blind spot is a risk.
• Gap with NIS2 directive: The European cybersecurity directive requires enhanced control over assets and risks. The firm needed to demonstrate compliance.

Actions Taken

Silent Extension Deployment

Avanoo deployed a browser extension across all workstations to detect actual usage without disrupting employee workflows.

SSO, Contract, and Policy Correlation

The platform cross-referenced usage data with the SSO directory, active contracts, and security policies to identify unapproved, risky, or non-compliant applications.

Automated Alerts and Nudging

Alerts were configured to flag new risky usage patterns and guide employees toward approved tools. Nudging messages were broadcast to encourage adoption of best practices.

Results

• 2,493 applications detected versus approximately 200 initially known
• 379 sensitive applications categorized and addressed according to risk level
• 15,000+ users covered by the discovery
• 60 days to complete mapping and initiate remediation

The firm now has full visibility into its Shadow IT and Shadow AI, with a clear roadmap to secure usage and strengthen NIS2 compliance.

Conclusion

Discovering Shadow IT in an environment of 15,000+ users may seem impossible in just a few weeks. Avanoo proved it could be done: in 60 days, the audit firm revealed over 2,400 applications and identified 379 sensitive usages to address. This visibility is the essential first step to securing the environment and aligning usage with regulatory requirements.