Shadow SaaS Discovery: How Cybersecurity Gateways Detect Unapproved Applications

What Shadow SaaS Discovery Is

Shadow SaaS discovery refers to the practice of identifying unauthorized Software as a Service (SaaS) applications that employees use without explicit approval from IT. Cybersecurity gateways, such as Cloud Access Security Brokers (CASBs), monitor network traffic to detect these shadow apps.

A CASB typically uses statistical methods and machine learning algorithms to score each connected application based on its behavior, looking for deviations from normal patterns or signatures that indicate potential security risks.

The Anomaly Scoring Formula

CASBs employ a formula known as Exponentially Weighted Moving Average (EWMA) to score traffic anomalies. This method assigns weights to recent and past data points, allowing the system to quickly adapt to new patterns while maintaining historical context.

The scoring is based on three key factors: rate deviation, signature mismatch, and traffic volume. Rate deviation measures how much the current traffic rate deviates from the baseline; signature mismatch identifies discrepancies between expected and actual application behavior; and traffic volume assesses the size of data transfers.

Why It Matters

Detecting shadow IT is crucial for maintaining security, compliance, and control over corporate resources. Unapproved applications can introduce vulnerabilities, expose sensitive data, and violate company policies.

By identifying these unauthorized apps early, CASBs help organizations mitigate risks, enforce security policies, and maintain a secure digital environment.

Real-World Examples

For instance, a CASB might detect an employee using a cloud storage service that isn't part of the company’s approved list. The gateway would score this traffic based on its deviation from normal patterns and block it if the threshold is exceeded.

Another example could involve identifying a new application that frequently sends large data files to external servers, which could indicate potential data exfiltration attempts.

Frequently asked questions

Try it live

Everything above runs in your browser — open Shadow SaaS Discovery: CASB Traffic Analysis (2D Top-Down) and change the parameters while it is running. Nothing is installed, nothing is uploaded, the whole model lives in one tab.