Shadow automation is any bot, scripted macro, scheduled workflow or no-code flow that runs on company data or systems without IT or security knowing about it. You find it by asking people, checking connection and account lists in your key systems, and looking at what runs on a schedule on shared machines.
Why it exists
People automate because it saves time, and tools make it easy. A finance analyst records a macro, an operations lead builds a flow that moves files and an assistant installs a desktop bot to copy data between screens. Most do it for good reasons. The OWASP Citizen Development Top 10 lists asset management failures as a risk for exactly this reason: you cannot protect what you did not know existed.
Where shadow automation hides
| Place | What you may find |
|---|---|
| Personal desktops | Recorded macros, scripts, attended bots |
| Shared drives | Scheduled scripts with passwords in them |
| SaaS admin pages | Connected apps and tokens that move data |
| No-code accounts | Flows built on personal sign ups |
| Email rules | Auto forwarding to outside addresses |
| Spreadsheets | Add-on scripts that call external services |
| Service account lists | Accounts with no owner |
How to find it in a week
- Ask. Send a short, friendly message to team leads: tell us about anything you automated, no blame, we want to protect it.
- List connected apps and authorised tokens in your main systems, such as email, file storage, chat and CRM. Each is a clue.
- List service and bot accounts in your directory and each key application. Mark any with no owner.
- Check scheduled tasks on shared servers and the machines you know run bots.
- Look at sign ups. Your finance and procurement records may show subscriptions to automation tools nobody told IT about.
- Add everything to one register with an owner, systems touched and data involved.
Our guide on how to build a low-code app inventory in one week walks through a similar pass.
What to do with what you find
Do not start by shutting things down. A bot that runs a payroll step may be critical. Sort each item into one of three bins:
- Keep as is: low risk, owner confirmed.
- Fix: move credentials into a store, replace a personal login with a dedicated account, narrow access.
- Retire: nobody uses it, or a safer tool already does the job.
Keep the friendly route open
If people fear punishment, they stop telling you. Offer a quick, easy way to register automation, a short checklist and a promise of help. Then shadow automation shrinks on its own, because the approved path is easier than the hidden one.
Repeat it
Run the sweep every quarter. New tools appear constantly, and last quarter's clean result says little about this quarter.
Where Safeguard fits
Safeguard's asset discovery helps surface systems and services in your environment you did not know about, which is a helpful starting point for the register.
Try it yourself
Click through the demo to see how a single inventory can drive tracking and follow-up. Notice how each item has an owner and a status, which is the same shape you want for your automation register.
Click through it at your own pace, or open it full screen.
Quick check
Is a spreadsheet macro really an automation risk?
It can be, if it holds credentials, touches sensitive data or calls outside services. Register the ones that do.
Who should own the shadow automation register?
IT or security can keep the register, but each entry needs an owner from the business team that built it.
Sources
Last reviewed: 19 October 2026.
