Software directory
Best Shadow IT Discovery Tools: 9 tools compared for 2026
Shadow IT discovery tools find software and cloud apps employees use without IT approval, via identity logs, email, browser extensions, finance data or network traffic.
- Tools compared
- 9
- Publish prices
- 2 of 9
- Free plan or trial
- 5 of 9
- Median G2 rating
- 4.6
Shadow IT Discovery Tools at a glance
| Tool | Best for | Pricing model | Starting price | G2 rating |
|---|---|---|---|---|
 BetterCloud | IT teams that want no-code on/offboarding and Google Workspace controls alongside license tracking. | per user | $0/month (Spend Optimization Basic) | 4.4 (479 reviews) |
 Torii | IT teams wanting discovery plus workflow automation. | custom | Contact sales | 4.5 (315 reviews) |
 Zluri | IT teams combining SaaS management with access reviews and onboarding automation. | custom | Contact sales | 4.6 (177 reviews) |
 Josys | Mid-size companies with Japanese operations or SmartHR as HRMS (Japanese pricing pages and HRMS integration) | per employee | Contact sales | 4.4 (106 reviews) |
 Netskope | Security teams already deploying or evaluating an SSE/SWG and wanting app risk scoring in the same inline path. | custom | Contact sales | 4.4 (68 reviews) |
 Zylo | Mid-size to large companies with a dedicated SaaS or IT ops owner. | custom | Contact sales | 4.7 (53 reviews) |
 Nudge Security | IT and security teams under 1,500 users that want published prices. | flat then per user | $750 per month billed annually (Essential, up to 150 users) | 4.6 (32 reviews) |
 Push Security | Security-led teams that want shadow IT and shadow AI visibility from the browser, including unmanaged devices. | per user | $5 per user/month billed annually | 4.8 (9 reviews) |
 Admina | Small and mid-size IT teams that want a low per-user entry price. | per user | $5 per user per month (third-party listing) | 4.6 (6 reviews) |
Prices as published by each vendor on October 24, 2026. "Contact sales" means no public price. G2 ratings read on the same day.
Security and contract checklist for shadow IT discovery tools
| Tool | SAML SSO | SCIM provisioning | Audit logs | Data residency | Contract | Support |
|---|---|---|---|---|---|---|
| BetterCloud | Not published | Not published | Not published | Not published | Custom quote based on licenses, connected apps, modules; volume and term discounts may apply. | Support center with guides; implementation and training included. |
| Torii | SAML 2.0 SSO supported for customer logins; plan availability not stated. | Not published | Not published | Hosted on AWS; regions not specified. | Not published | Email support@toriihq.com and phone; plan tiers not stated. |
| Zluri | Not published | Not published | Not published | Not published | MSA and Terms linked, contents not reviewed. | Help docs, support portal and a Trust Center linked; no support tiers published. |
| Josys | SSO/2FA listed under enterprise-grade features; plan not specified. | Not published | Audit logs and audit trails listed as features on pricing page; plan not specified. | Not published | 14-day free trial of the full platform, no credit card; price based on number of identities governed. | Onboarding support included in every plan; dedicated Technical Account Manager listed under enterprise features; support@josys.com. |
| Nudge Security | Okta SSO sign-in included for every customer at no extra cost. | Not published | Not published | Not published | Annual billing; no auto-renewal; account and data can be deleted any time. | Enterprise includes dedicated product success and onboarding support. |
| Push Security | Not published | Not published | Admin audit logs (regular and extended) listed on pricing page; every license includes the full platform. | EU: Dublin, backup in Paris. | Billed in advance by card (Stripe) or bank transfer; seats can be added or removed anytime; 12-month initial term per terms. | Not published |
| Admina | Not published | Not published | Not published | Not published | 14-day free trial; enterprise is custom pricing; monthly vs annual terms not stated by the vendor. | Chat support on SMB tier; dedicated success manager and priority support on enterprise (500+ employees) |
Which plan includes SSO, SCIM and audit logs often decides the real price. "Not published" means the vendor's public pages do not say; ask before you sign.
How to compare shadow IT discovery tools
- Discovery sources. Determines coverage.
- Agent or extension required. Rollout effort.
- App risk scoring. Security triage.
- Remediation workflows. Discovery alone is not enough.
- AI app detection. Current buyer priority.
- Pricing. SMB fit.
- Integrations. IdP, email, MDM.
| Tool | Discovery sources | Agent or extension required | App risk scoring | Remediation workflows | AI app detection | Pricing | Integrations |
|---|---|---|---|---|---|---|---|
| BetterCloud | SSO, direct integrations and a Chrome extension for usage insights (vendor pricing page) | Browser extension only for usage insights. | Not verified | Workflow automation can act on findings. | Not verified | License-based custom quote, modular. | 100+ native integrations plus open API. |
| Torii | Not verified | Not verified | Not verified | Not verified | AI Management product. | Quote only. | Integration list published on vendor site; count not verified. |
| Zluri | Discovers identities across SaaS, cloud and enterprise apps via an identity graph; specific sources not verified. | Not verified | Not verified | Not verified | Not verified | Quote only. | Not verified |
| Josys | IdP integrations (Okta, Entra ID, Google Workspace), activity signals, browser extension; 50K-app shadow IT engine. | Browser extension optional; IdP-based discovery needs none. | Not verified | Access reviews, secure offboarding, policy drift detection. | AI-agent and non-human identity discovery listed. | Per governed identity, quote only. | 350+ native integrations (SaaS plan page says 300+ direct) |
| Netskope | Inline traffic analysis; apps classified with GenAI models. | Traffic must be steered through Netskope (client/proxy); exact options not verified. | Cloud Confidence Index scores 80,000+ SaaS apps on 50+ attributes. | Block, restrict specific actions, redirect users to sanctioned alternatives, apply DLP inspection. | GenAI-based app classification; AI app coverage specifics not verified. | Quote-based. | Not verified |
| Zylo | Zylo Discover: standalone SaaS discovery and inventory launched 2024; specific sources not verified. | Not verified | Not verified | Not verified | Not verified | Quote only. | Not verified |
| Nudge Security | Mailbox scanning in Google Workspace or Microsoft 365 plus browser extension for login activity. | No endpoint agent; browser extension optional. | Not verified | Not verified | Discovers GenAI tools in use per pricing page. | Flat $750 per month up to 150 users, then $5 per user per month. | Sample: Microsoft 365, Google Workspace, Okta, Salesforce, Snowflake, Zoom; no count published. |
| Push Security | Browser extension watches logins and account creation. | Yes, browser extension (MDM, direct install, email enrollment, self-enrollment, BYOD) | Not verified | Policy enforcement can block unsanctioned tools; Slack and Teams alerts. | Shadow AI apps, agentic browsers (Comet, Atlas, Dia), AI prompt and upload monitoring, AI OAuth permissions. | Per employee per month. | SIEM (Sentinel, Splunk, Datadog, Panther, Cribl, SentinelOne), Slack, Teams, Tines, Okta, Google Workspace, Microsoft 365, REST API. |
| Admina | API/OAuth connectors to SaaS apps plus Chrome/Edge browser extension; blog also names ERP and accounting software as sources. | No endpoint agent stated; browser extension optional for apps without APIs. | Not verified | Provision and de-provision users per G2 listing; no remediation playbooks verified. | Not verified | About $5 per user per month per third-party listings; enterprise custom. | 200+ direct SaaS integrations (OAuth, API or scraping) |
The 9 tools in detail
BetterCloud
SaaS management and user-lifecycle automation platform that started in Google Workspace administration and now adds license, contract and renewal tracking.
- Starting price
- $0/month (Spend Optimization Basic)
- Pricing model
- per user
- G2 rating
- 4.4 (479 reviews)
- Discovery sources
- SSO, direct integrations and a Chrome extension for usage insights (vendor pricing page)
- Agent or extension required
- Browser extension only for usage insights.
- Remediation workflows
- Workflow automation can act on findings.
- Pricing
- License-based custom quote, modular.
Choose it if
- IT teams that want no-code on/offboarding and Google Workspace controls alongside license tracking.
- Teams that want to buy only the modules they need (Spend Optimization, User Automation, Workspace Management)
Skip it if
- Finance-led buyers who need card and ERP spend feeds as the main data source (vendor describes SSO, direct integrations and a Chrome extension)
- Buyers who want published prices beyond the free Spend Optimization Basic tier.
Worth knowing
- Acquired by CoreStack on 2026-03-31 and positioned as an agentic governance layer across cloud, SaaS and AI; the former CEO stepped down at close and a CoreStack executive became president.
- Spend Optimization Basic is the only published price ($0); everything else is a license-based quote with modules bought separately.
- Usage insight depends on a Chrome extension plus SSO and API integrations, so coverage differs from finance-feed tools.
Torii
Torii is a SaaS management platform that discovers apps, tracks spend and renewals, and automates access workflows.
- Starting price
- Contact sales
- Pricing model
- custom
- G2 rating
- 4.5 (315 reviews)
- AI app detection
- AI Management product.
- Pricing
- Quote only.
- Integrations
- Integration list published on vendor site; count not verified.
Choose it if
- IT teams wanting discovery plus workflow automation.
- Companies that want one vendor for SMP and identity governance.
Skip it if
- Buyers who need public pricing to budget.
- Teams reporting integration and onboarding workflow gaps.
Worth knowing
- Pricing page splits into SMP, IGA and AI Management, so identity governance is a separate purchase.
- Torii says it was a Leader in Gartner's SaaS Management Platforms Magic Quadrant three years running (vendor claim)
- Headcount was 95 in 2023 after a 28 person layoff (Calcalist); last funding was 2022.
Zluri
Zluri is a SaaS management and identity governance platform that maps access across SaaS, cloud and enterprise apps.
- Starting price
- Contact sales
- Pricing model
- custom
- G2 rating
- 4.6 (177 reviews)
- Discovery sources
- Discovers identities across SaaS, cloud and enterprise apps via an identity graph; specific sources not verified.
- Pricing
- Quote only.
Choose it if
- IT teams combining SaaS management with access reviews and onboarding automation.
- Mid-size companies wanting security certifications up front.
Skip it if
- Buyers who need published pricing.
- Teams that cannot pay for enterprise tiers of connected apps.
Worth knowing
- Pricing page lists four products (IVIP, IGA, ISPM, SMP), so scope of a quote varies.
- Security page badges include SOC 2, ISO 27001, ISO 27701, GDPR and PCI DSS (logos on vendor page; verify reports)
- A G2 reviewer notes some connectors only work with the target app's enterprise plan.
Josys
SaaS and identity management platform from a Japan-rooted vendor that discovers apps via IdP, activity signals and a browser extension.
- Starting price
- Contact sales
- Pricing model
- per employee
- G2 rating
- 4.4 (106 reviews)
- Discovery sources
- IdP integrations (Okta, Entra ID, Google Workspace), activity signals, browser extension; 50K-app shadow IT engine.
- Agent or extension required
- Browser extension optional; IdP-based discovery needs none.
- Remediation workflows
- Access reviews, secure offboarding, policy drift detection.
- AI app detection
- AI-agent and non-human identity discovery listed.
Choose it if
- Mid-size companies with Japanese operations or SmartHR as HRMS (Japanese pricing pages and HRMS integration)
- IT teams wanting discovery plus access reviews and on/offboarding in one tool.
Skip it if
- Buyers who need public list prices (price set per governed identity, quote only)
- Teams needing very deep integrations with every niche SaaS: some reviewers cite a limited range for certain apps.
Worth knowing
- Price is per governed identity, not per app or percent of spend.
- Vendor pricing page gives inconsistent customer counts (1000+ vs over 600 companies).
- Missing IdPs get a custom integration in 2 to 3 days (vendor claim).
Netskope
Security service edge platform whose CASB finds unsanctioned cloud apps from inline traffic and scores them for risk.
- Starting price
- Contact sales
- Pricing model
- custom
- G2 rating
- 4.4 (68 reviews)
- Discovery sources
- Inline traffic analysis; apps classified with GenAI models.
- Agent or extension required
- Traffic must be steered through Netskope (client/proxy); exact options not verified.
- App risk scoring
- Cloud Confidence Index scores 80,000+ SaaS apps on 50+ attributes.
- Remediation workflows
- Block, restrict specific actions, redirect users to sanctioned alternatives, apply DLP inspection.
Choose it if
- Security teams already deploying or evaluating an SSE/SWG and wanting app risk scoring in the same inline path.
- Enterprises needing to block, restrict or DLP-inspect risky app use, not only discover it.
Skip it if
- IT or finance teams wanting license and renewal tracking (not what the CASB provides)
- Small companies without a security team to run traffic steering.
Worth knowing
- Discovery comes from inline traffic, so visibility depends on how much traffic is steered through Netskope.
- Cloud Confidence Index (CCI) covers 80,000+ apps and draws on Cloud Security Alliance attributes (50+ attributes)
- Response goes beyond reporting: block, limit actions, redirect or DLP-inspect.
Zylo
Enterprise SaaS management platform covering discovery, license, spend and renewals, sold on annual quote.
- Starting price
- Contact sales
- Pricing model
- custom
- G2 rating
- 4.7 (53 reviews)
- Discovery sources
- Zylo Discover: standalone SaaS discovery and inventory launched 2024; specific sources not verified.
- Pricing
- Quote only.
Choose it if
- Mid-size to large companies with a dedicated SaaS or IT ops owner.
- Buyers wanting discovery, license and renewal in one platform.
Skip it if
- Small companies on a tight budget (Vendr data shows about $35K per year median)
- Teams wanting public pricing or self-serve start.
Worth knowing
- Median buyer pays about $35K per year per Vendr data, enterprise-weighted.
- Zylo Discover launched in 2024 as a standalone discovery and inventory product.
- Vendr buyer guide and marketplace give different averages ($36K vs $34.9K)
Nudge Security
SaaS and AI discovery tool that finds apps by scanning employee mailboxes, with a security governance focus.
- Starting price
- $750 per month billed annually (Essential, up to 150 users)
- Pricing model
- flat then per user
- G2 rating
- 4.6 (32 reviews)
- Discovery sources
- Mailbox scanning in Google Workspace or Microsoft 365 plus browser extension for login activity.
- Agent or extension required
- No endpoint agent; browser extension optional.
- AI app detection
- Discovers GenAI tools in use per pricing page.
- Pricing
- Flat $750 per month up to 150 users, then $5 per user per month.
Choose it if
- IT and security teams under 1,500 users that want published prices.
- Companies with Google Workspace or Microsoft 365 who want agentless discovery.
Skip it if
- Companies without Google Workspace or Microsoft 365 mailboxes.
- Finance teams that want ERP or card-feed based spend analytics.
Worth knowing
- Discovery reads employee mailboxes in Google Workspace or Microsoft 365, so it is only as good as the mail tenant it connects to.
- The browser extension is what adds real login metrics; without it you see sign-up evidence, not usage.
- Pricing is public and unusually simple: flat $750 per month up to 150 users, then $5 per user per month to 1,500.
Push Security
Browser-extension security platform that finds SaaS accounts, shadow AI use and weak logins as employees use them.
- Starting price
- $5 per user/month billed annually
- Pricing model
- per user
- G2 rating
- 4.8 (9 reviews)
- Discovery sources
- Browser extension watches logins and account creation.
- Agent or extension required
- Yes, browser extension (MDM, direct install, email enrollment, self-enrollment, BYOD)
- Remediation workflows
- Policy enforcement can block unsanctioned tools; Slack and Teams alerts.
- AI app detection
- Shadow AI apps, agentic browsers (Comet, Atlas, Dia), AI prompt and upload monitoring, AI OAuth permissions.
Choose it if
- Security-led teams that want shadow IT and shadow AI visibility from the browser, including unmanaged devices.
- Companies under 500 employees wanting a published per-seat price.
Skip it if
- Finance teams seeking spend, contract and renewal management (not a described feature)
- Buyers who cannot deploy a browser extension.
Worth knowing
- Discovery is from a browser extension, so it sees logins and accounts that SSO and finance feeds miss, but only on browsers where it is installed.
- Works on unmanaged and BYOD devices without MDM.
- Standard plan caps at 500 employees; larger companies go to custom pricing.
Admina
SaaS management and shadow IT discovery tool from Japanese fintech group Money Forward, combining API connectors with a browser extension.
- Starting price
- $5 per user per month (third-party listing)
- Pricing model
- per user
- G2 rating
- 4.6 (6 reviews)
- Discovery sources
- API/OAuth connectors to SaaS apps plus Chrome/Edge browser extension; blog also names ERP and accounting software as sources.
- Agent or extension required
- No endpoint agent stated; browser extension optional for apps without APIs.
- Remediation workflows
- Provision and de-provision users per G2 listing; no remediation playbooks verified.
- Pricing
- About $5 per user per month per third-party listings; enterprise custom.
Choose it if
- Small and mid-size IT teams that want a low per-user entry price.
- Companies with Japanese subsidiaries or Money Forward accounting already in use.
Skip it if
- Buyers who need a large Western-market review base to validate the vendor (G2 has only 6 reviews)
- Teams that need deep risk scoring or security remediation playbooks.
Worth knowing
- The browser extension feeds usage data from Chrome or Edge, which lets Admina flag inactive accounts for apps that have no API (support.i.moneyforward.com).
- Admina states its database covers over 190,000 SaaS tools, which is what the extension matches against.
- Detected apps appear under Integrations > Shadow IT in the console, so discovery and managed connectors live in one list.
Frequently asked questions
What are shadow IT discovery tools?
Shadow IT discovery tools find software and cloud apps employees use without IT approval, via identity logs, email, browser extensions, finance data or network traffic.
Which shadow IT discovery tools publish their pricing?
2 of the 9 tools we compared publish prices: Nudge Security ($750 per month billed annually (Essential, up to 150 users)); Push Security ($5 per user/month billed annually). The others quote on request, so ask for a written quote that names the seat or spend basis, the term and the renewal uplift.
Which shadow IT discovery tools have a free plan or free trial?
BetterCloud (free plan, free trial), Josys (free trial), Nudge Security (free trial), Push Security (free trial) and Admina (free trial), according to the vendors' sites on October 24, 2026.
Which shadow IT discovery tools include SSO below the enterprise plan?
Torii (SAML 2.0 SSO supported for customer logins; plan availability not stated); Nudge Security (Okta SSO sign-in included for every customer at no extra cost). The other tools either reserve SAML SSO for their enterprise tier or do not say on their public pages.
Which shadow IT discovery tools are rated highest on G2?
Among tools with at least 20 G2 reviews: Zylo 4.7 from 53 reviews, Zluri 4.6 from 177 reviews, Nudge Security 4.6 from 32 reviews. Ratings were read on October 24, 2026; small review counts move quickly, so read recent reviews from companies your size.