Shadow IT Is Expanding Your Attack Surface. Here’s Proof

Shadow IT, defined as systems your security team doesn’t know about, is expanding your attack surface, and researchers note that unmanaged assets frequently slip through policies. According to Intruder, a security team’s testing over a few days uncovered real-world exposures such as unsecured backups, open Git repositories, unauthenticated admin panels, and more, with every instance containing sensitive data or credentials.

The findings also show how subdomain enumeration and Certificate Transparency logs can reveal vast numbers of potential targets, including approximately 30 million hosts, underscoring the scale of hidden assets that may never enter formal vulnerability management. Exposed backups were among the simplest to detect, often listing directory contents and even active credentials or complete database dumps, sometimes with hardcoded tokens.

Unsecured Git servers carried secrets for external services, while some admin panels left authentication or proper access controls entirely absent, exposing infrastructure logs, application data, and even chatbot messages. Intruder’s guidance emphasises continuous subdomain enumeration and feeding discovered assets into vulnerability management to prevent attackers from acting on these blind spots.