The tools beneath the iceberg
An inventory revealed that the tools IT knew about were only the tip of the iceberg.
(Illustrative scenario, not a real incident)
A-Zhe has run IT for several yearsat an online shop selling home fragrances.
The company was pursuing a security certification,and the first step was an inventory.
He started by listing the cloud services the company officially paid for:a dozen or so, all clear.Then he asked every department to fill out a form:“Which online tools do you use day to day?”
When the forms came back, the count had more than doubled.
Some employees had signed up for AI tools on their ownwith their company accounts;some tools had been connected to the company's cloud drive.
A-Zhe stared at the screen and said:“I've never seen any of these.”
What you see is the list in IT's hands.What you don't see is the vast stretch outside it:no one set permissions, no one turned on two-step verification,and when someone left, no one thought to take it back.
Where customer data had been pasted,the company couldn't say.
And that form is only the lower bound.Self-reported lists always miss things.
Laozi said: “He who knows others is wise; he who knows himself is enlightened.”Seeing others clearly is cleverness;seeing yourself clearly is true understanding.
An inventory is simply seeing your own house clearly first.
- Export the past year of company card statements and filter out the subscription charges.
- Send a three-question survey: what do you use, what for, and have you put company data in it?
- Write down one “person” as the owner of each tool.
- Run it again every quarter.