Open-source SaaS subscription management platform — discover unused subscriptions, match payments to apps, and manage users, seats, and costs.
Network device vendor analysis tool - Transform MAC address tables into interactive dashboards, detect new vendors, and export SIEM events for security monitoring. Supports Cisco, Juniper, HP/Aruba, Extreme, Brocade and more.
Open-source platform for governed deployment of AI-generated internal apps.
A PowerShell tool to identify and audit user-consented applications in Microsoft Entra ID (Azure AD), with a focus on uncovering "Shadow IT" and security risks.
Passive Attack Surface & Shadow IT Intelligence Engine (Online + Offline)
Privacy-bounded browser extension that discovers SaaS and AI tools on-device (hostnames + day-level time only, zero network egress). Apache-2.0.
Discover shadow n8n automations running on laptops and servers, and map which production credentials they can reach - the self-hosted automation blind spot SaaS discovery tools miss
Tactical Attack Surface Management (ASM) & Shadow IT Intelligence Framework.
Free discovery tool that scans GitHub orgs, Slack workspaces, and local filesystems for unauthorized AI provider, cloud, and dev-platform credentials.
Detect the SaaS/tech stack a website runs — static signatures + an optional headless Playwright probe. TypeScript, zero-dependency core, tested.
Local CLI to discover shadow MCP servers on your local network & audit authentication status. Zero telemetry, local-only.
Enterprise integration of Microsoft Defender for Cloud Apps (MDCA) with Microsoft Defender for Endpoint (MDE) — Shadow IT detection, OAuth app governance, and SaaS security posture management across a 31,000+ app catalogue.
Self-learning stealth reconnaissance platform for red teamers and pentesters. Continuous internal network mapping with 11 discovery techniques, ML-powered anomaly detection, and zero IDS alerts. Scales more than 200K+ hosts.
Command-line tool for managing MCP Servers with no shadow code
🌊 Fathom — Attack Surface Intelligence, Made Simple. Discover subdomains, uncover Shadow IT, fingerprint technologies, and prioritize your external attack surface—no API keys required.
SENTINEL is an immersive insider threat detection and training platform designed for security analysts, SOC teams, and IT professionals. Featuring a fully simulated UEBA (User and Entity Behavior Analytics) environment, interactive threat simulations, and comprehensive indicators of compromise (IOCs) library🔒👨🏿💻.
Find every third-party app your users granted OAuth access to — which AI tools are in use, and which unknown apps hold dangerous permissions.
App to help users pick appropriate AI tool based on user selected criteria
To associate your repository with the shadow-it topic, visit your repo's landing page and select "manage topics."