Understanding Shadow IT
Shadow IT assets are often unused or unmanaged by internal staff, yet they can still pose significant risks. Idle or outdated servers, for example, may go unpatched and become potential backdoors into your systems. By identifying and managing these unauthorised or forgotten assets, you can reduce security vulnerabilities, lower operational costs, and improve resource efficiency.
Maintaining visibility into your IT environment also supports compliance efforts by demonstrating that you are in control of your infrastructure and are not exposing the network to unauthorised or unmanaged devices.
How Faddom Helps
Faddom uses traffic and usage statistics to identify servers that are not actively being used. In some cases, these servers may still be legitimate, for example, QA environments accessed only on a periodic basis. In others, they may belong to outdated projects that were never properly decommissioned.
Faddom flags these under Shadow IT, highlighting potential risks associated with forgotten or unmanaged infrastructure.
How Shadow IT Detection Works
Faddom classifies a server as Shadow IT if it shows low traffic and minimal to no changes in collected data over a rolling 7-day period. By default, data is collected daily, although this frequency can be modified via the Scheduler.
Configuring Shadow IT Detection
By default, Shadow IT detection runs across all subnets. You can fine-tune this behavior as follows:
Navigate to Secure > Shadow IT.
Click Settings.
Select the subnet(s) you want to scan.
Add any IPs or ports you want to exclude.
Click Save to apply changes at the next scheduled check, or Save and Run Now to update immediately.
Once updated, return to the Shadow IT dashboard to review the servers flagged based on your updated settings.
Using the Shadow IT Dashboard
When you open Secure > Shadow IT, you will see a categorized list of flagged servers, broken down into:
Total Servers
Vulnerable Servers
Servers with EoL/EoS Operating Systems
You can:
Filter by All Subnets or a specific subnet.
Use the search box to locate specific servers.
Click Vulnerable Servers to view systems affected by known CVEs.
Click Servers with EoL/EoS - OS to see which servers are running unsupported operating systems.
Exporting the Data
To export the Shadow IT data click the Export button to download a CSV file containing the current view.