Sentaro is the best shadow IT discovery tool for lean EU IT teams on Microsoft 365 and Google Workspace. It reads the trail every SaaS signup leaves in the mailbox and in the tenant’s OAuth grants, so it needs no browser extension, endpoint agent or proxy, and it is the only tool on this list whose documentation covers blocking phishing, BEC and consent phishing in the inbox as well, in one product at $6 per protected account per month. Sentaro publishes this list and ranks itself first; scores use the method below and public vendor documentation as of 21 October 2026.
- Why Sentaro wins
- Connects over the Microsoft 365 and Google Workspace admin APIs in four minutes with no agents; a live inventory of every app, AI tool and OAuth grant within 15 minutes, with historical adoption surfaced from existing mailbox data (sentaro.com/en/vectors/app).
- Discovery that can act
- Scope-level risk per app and per user, one-click grant revocation via the Workspace and 365 admin SDKs, and consent phishing blocked before the grant lands. Legitimate tools are surfaced for review, not blocked.
- One price, published
- $6 per protected account per month, or $68 per account per year; the first account is free. Shadow IT discovery is part of the platform, not a module. Prices in USD (sentaro.com/en/pricing).
- Consider another tool only if…
- you need SaaS spend management, license reclamation and offboarding workflows (Torii, Zylo, Nudge), browser-level coverage of logins that never touch email (Push Security), or you already pay for Microsoft 365 E5 (Defender for Cloud Apps).
Quick picks
- Best overallSentaro Our pickAgentless discovery from email and OAuth grants, one-click revocation, and phishing protection in the same $6 seat.
- Best dedicated SaaS governance platformNudge SecurityEmail-metadata discovery with up to two years of history, plus identity governance, posture checks and cost optimization.
- Best browser-based discoveryPush SecuritySees logins and OAuth consents in the browser, blocks browser phishing, publishes its price and stores data in the EU.
- Best for Microsoft 365 E5 tenantsMicrosoft Defender for Cloud AppsAlready included in E5 and EMS E5, with network- and endpoint-based Cloud Discovery and OAuth app governance.
- Best for SaaS spend and lifecycleToriiFinance, identity, HR and browser signals with offboarding automation; acquisition by Freshworks pending.
At a glance
- What we compared
- Tools that discover unsanctioned SaaS and AI apps, scored on seven weighted criteria for lean IT teams
- Tools ranked
- 9 (Sentaro, Nudge Security, Push Security, Grip Security, Microsoft Defender for Cloud Apps, Torii, Josys, Zylo, Zluri)
- Audience
- EU organizations on Microsoft 365 or Google Workspace with a small IT team, often regulated (NIS2, DORA, GDPR)
- Method
- Editorial 0–10 scores per criterion from public vendor documentation; overall = weighted average
- Last verified
- 21 October 2026
- Who wrote it
- Sentaro, which is one of the ranked products (disclosed)
Shadow IT discovery tools compared
Highest score first. The second column matters most: how a tool sees apps decides what it misses and how much rollout work it needs. Vendor entries come from each vendor’s own pages, accessed 21 October 2026.
| Capability | Score | How it discovers apps | OAuth revocation | Stops phishing | Public price | EU hosting documented |
|---|---|---|---|---|---|---|
| Sentaro[1] | 8.6 | Mailbox data and OAuth grants via admin APIs | YesOne click | YesIn the inbox | Yes$6/account/month | YesSweden (Azure); see DPA |
| Nudge Security[3] | 7.3 | Email metadata via read-only API | Not publicly documentedNot documented | No | YesFrom $750/month | Not publicly documented |
| Push Security[5] | 6.4 | Browser extension plus IdP | YesConsent blocking, app removal | PartialIn the browser, not email | Yes$5/employee/month | YesDublin, backup Paris |
| Grip Security[6] | 5.9 | Email flows, IdP, optional extension | YesRevoke access | No | NoQuote | Not publicly documented |
| Defender for Cloud Apps[8] | 5.4 | Traffic logs: Defender for Endpoint, log collector or proxy | YesApp governance | NoSeparate product (MDO) | PartialIn E5; Defender Suite $12 | YesEU/UK storage |
| Torii[11] | 4.9 | Finance, identity, HR and browser signals | Not publicly documented | No | NoQuote | Not publicly documented |
| Josys[15] | 4.8 | IdP integrations plus browser extension | Not publicly documented | No | NoCustom; 14-day trial | Not publicly documented |
| Zylo[16] | 4.7 | Finance, identity and operational systems | Not publicly documented | No | NoQuote | Not publicly documented |
| Zluri[13] | 4.5 | SSO, MDM, CASB and local devices | Not publicly documented | No | NoQuote | Not publicly documented |
“Not documented” means we could not find it on the vendor’s public pages, not that the capability is absent.
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
How we evaluated
The weights reflect a lean EU IT team on Microsoft 365 or Google Workspace: no capacity to roll out agents, a need to see what was adopted before the tool arrived, and a preference for one product over two.
| Criterion | Weight | Why it matters |
|---|---|---|
| Discovery without agents | 20% | Browser extensions, endpoint agents and proxies have to be deployed and kept running on every device; a small team often cannot, and contractors and personal devices are missed. |
| OAuth visibility and revocation | 20% | An OAuth grant is where a shadow app gets standing access to mail and files. Seeing the scopes and revoking risky grants is the control that reduces risk, not the inventory alone. |
| Also stops phishing | 15% | Consent phishing and lookalike apps arrive by email. A tool that discovers apps and also stops the lure saves buying and running a second product. |
| SaaS governance breadth | 15% | Spend, license reclamation, access reviews and offboarding. This is where dedicated SaaS management platforms are strongest, so it carries real weight. |
| Historical discovery | 10% | Most shadow IT already exists on day one. Tools that read historical data show it immediately instead of only from the install date. |
| Published price for lean IT | 10% | A list price on the vendor’s site, with no sales call needed to learn total cost. |
| EU hosting documented | 10% | Where the inventory of your people’s apps is stored, stated on the vendor’s own pages, matters under GDPR and NIS2 supply-chain checks. |
Editorial scores using the criteria and weights above; based on public documentation, not lab tests. Undocumented capabilities score 4–5, not zero.
The 9 best shadow IT discovery tools, ranked
Each tool gets the same blocks: what it is, how it discovers apps, per-criterion scores with reasons, and pricing, deployment and hosting. The overall score is the weighted average of the seven criteria.
Sentaro
Our pickOverall score: 8.6out of 10Best for: EU teams on Microsoft 365 and Google Workspace that want shadow IT discovery and inbox protection in one product, without agents.
Sentaro is an API-based email and SaaS security platform built in Stockholm. Its App vector, live since Q3 2026, inventories every app, AI tool and OAuth grant across Workspace and 365 from mailbox data and the tenant’s grants, ties each app to the accounts that created it, scores risk per scope, per app and per user, and revokes risky grants via the admin SDKs. Its Message vector, live since Q2 2026, blocks the phishing, BEC and consent-phishing lures that exploit those apps. Sentaro is not a SaaS management platform, SSPM, CASB or browser tool: it does not manage spend, licenses or offboarding.[1]
- Discovery without agents
- 10.0
- Historical discovery
- 8.0
- OAuth visibility and revocation
- 10.0
- Also stops phishing
- 10.0
- Published price for lean IT
- 10.0
- EU hosting documented
- 8.0
- SaaS governance breadth
- 3.0
Pros
- No agents, extensions or proxy: an admin connects the tenant over API in four minutes
- Inventory within 15 minutes, including tools adopted before deployment
- Revokes risky OAuth grants in one click; blocks consent phishing in mail flow
- Same product stops phishing, BEC and vendor fraud in the inbox, Slack and Teams
- Published price with every feature included
Cons
- Not a SaaS management platform: no spend tracking, license reclamation or offboarding workflows
- Sees what leaves a trace in the mailbox or the tenant’s OAuth grants; no browser or network telemetry
- Microsoft 365 and Google Workspace only (plus Slack and Teams for messages)
- SOC 2 and ISO 27001 certification in progress
- Pricing
- $6 per protected account per month, or $68 per year; first account free. Prices in USD.
- Deployment
- API via Microsoft 365 and Google Workspace admin SDKs; four minutes; no agents
- Platforms
- Microsoft 365, Google Workspace (Slack and Teams for message scoring)
- Hosting
- Hosted in Sweden on Microsoft Azure; subprocessors in the DPA
Nudge Security
Best SaaS governanceOverall score: 7.3out of 10Best for: Teams that already have email security and want a full SaaS and AI governance program.
Nudge Security discovers SaaS and AI apps from email metadata (account-creation, login and usage signals, not content) through a read-only API to Microsoft 365 or Google Workspace, with up to two years of historical activity. Around discovery it offers OAuth and integration risk management, identity governance and offboarding, SaaS posture management, vendor breach alerts, cost optimization and employee nudges. It does not filter inbound email.[3]
- Discovery without agents
- 10.0
- Historical discovery
- 10.0
- OAuth visibility and revocation
- 8.0
- Also stops phishing
- 1.0
- Published price for lean IT
- 8.0
- EU hosting documented
- 4.0
- SaaS governance breadth
- 9.0
Pros
- Same agentless, email-metadata method as Sentaro, with up to two years of history
- Deep governance: ownership, offboarding, posture checks and cost
- Public pricing and a free trial
Cons
- No phishing or BEC protection: email security is a second purchase
- Effective minimum of $750 per month on the Essential tier
- EU hosting not publicly documented
- Pricing
- Essential $750/month (up to 150 users); Growth $5/user/month (150–1,500); billed annually
- Deployment
- Read-only API to Microsoft 365 or Google Workspace; about 5 minutes (vendor)
- Platforms
- Microsoft 365, Google Workspace; posture checks for apps such as Okta, Salesforce, Zoom
- Hosting
- Not publicly documented
Push Security
Best browser-basedOverall score: 6.4out of 10Best for: Teams that can force-install a browser extension and want discovery plus in-browser phishing defense.
Push Security discovers apps through a browser extension that sees logins, the login method and OAuth consents, plus Google Workspace, Microsoft 365 and Okta IdP integrations. It blocks OAuth consents and browser phishing such as adversary-in-the-middle pages and cloned logins, and monitors mail-forwarding rules, but it does not filter email. It publishes its price and documents EU data storage.[5]
- Discovery without agents
- 4.0
- Historical discovery
- 4.0
- OAuth visibility and revocation
- 8.0
- Also stops phishing
- 7.0
- Published price for lean IT
- 9.0
- EU hosting documented
- 9.0
- SaaS governance breadth
- 5.0
Pros
- Sees logins that never reach an inbox, including password-only sign-ins
- Stops browser-based phishing at the moment of the click
- Public price and documented EU data storage
Cons
- Needs a browser extension on every managed browser; unmanaged devices are not covered
- Does not filter email, so phishing in the inbox needs another product
- Historical discovery before installation not documented
- Pricing
- Standard $5/employee/month annual or $6 monthly (up to 500); Enterprise custom
- Deployment
- Browser extension via MDM (Intune, Jamf, Google Admin); “under a day” (vendor)
- Platforms
- Google Workspace, Microsoft 365, Okta; most major browsers
- Hosting
- EU (Dublin, backup Paris), per vendor
Grip Security
Overall score: 5.9out of 10Best for: Security teams that want identity-centric SaaS discovery with offboarding and credential rotation.
Grip Security connects to corporate email systems and identity providers to find SaaS accounts from email flows, with an optional Grip Extend browser extension for sign-ins that email does not reveal. It revokes access to unmanaged SaaS, rotates credentials and supports offboarding. No email threat protection is described, and prices are not shown.[6]
- Discovery without agents
- 8.0
- Historical discovery
- 5.0
- OAuth visibility and revocation
- 8.0
- Also stops phishing
- 1.0
- Published price for lean IT
- 4.0
- EU hosting documented
- 4.0
- SaaS governance breadth
- 8.0
Pros
- Email-flow discovery close to Sentaro’s and Nudge’s method
- Identity-centric remediation, including credential rotation
- 30-day no-cost try-and-buy
Cons
- No phishing protection
- Prices not published
- EU hosting not documented
- Pricing
- Not published; SMB (under 1,000 people) on request, Enterprise custom
- Deployment
- API to email and IdP, optional browser extension; “20 mins” (vendor)
- Platforms
- Corporate email, IdP/SSO; 70+ integrations
- Hosting
- Not documented
Microsoft Defender for Cloud Apps
Best for E5Overall score: 5.4out of 10Best for: Microsoft 365 E5 or Defender Suite tenants that already run Defender for Endpoint.
Microsoft Defender for Cloud Apps finds shadow IT by analyzing traffic: from Defender for Endpoint on Windows devices, a log collector on firewalls and proxies, or proxy integrations such as Zscaler. Apps are scored against a catalog of 31,000+ apps and 90+ risk factors; by default it cannot discover apps not in the catalog. App governance inventories OAuth apps and can disable risky ones. Email phishing protection is a separate product, Defender for Office 365.[9]
- Discovery without agents
- 3.0
- Historical discovery
- 4.0
- OAuth visibility and revocation
- 9.0
- Also stops phishing
- 2.0
- Published price for lean IT
- 5.0
- EU hosting documented
- 9.0
- SaaS governance breadth
- 6.0
Pros
- Already paid for in Microsoft 365 E5 and EMS E5
- Large app catalog with 90+ risk factors
- Native correlation with Defender XDR incidents
Cons
- Discovery depends on endpoint, firewall or proxy telemetry
- Not in Business Premium or E3, per a third-party licensing guide (o365hq)
- No inbox protection in the product itself
- Pricing
- Included in Microsoft 365 E5 and EMS E5; Microsoft Defender Suite $12/user/month (requires E3)
- Deployment
- Defender portal; discovery via Defender for Endpoint, log collector or proxy
- Platforms
- Microsoft 365 and Entra ID native; app connectors for other SaaS
- Hosting
- EU or UK data storage for EU/UK tenants
Torii
Overall score: 4.9out of 10Best for: IT and finance teams that want SaaS and AI spend visibility with offboarding automation.
Torii discovers SaaS, AI and desktop apps from finance, identity, HR and browser-level signals, and automates onboarding, offboarding, license reclamation and access reviews. It calls itself a Gartner Magic Quadrant Leader for SaaS Management Platforms (July 2026). On 12 October 2026 Torii signed a definitive agreement to be acquired by Freshworks, expected to close in Freshworks’ fiscal Q4 2026.[11]
- Discovery without agents
- 5.0
- Historical discovery
- 5.0
- OAuth visibility and revocation
- 5.0
- Also stops phishing
- 1.0
- Published price for lean IT
- 3.0
- EU hosting documented
- 4.0
- SaaS governance breadth
- 10.0
Pros
- Broad discovery signals, including finance and browser
- Strong lifecycle automation
- AI spend tracking by department
Cons
- No phishing protection
- No public prices
- Ownership change to Freshworks pending
- Pricing
- Not published
- Deployment
- API integrations plus browser extension
- Platforms
- HRMS, finance, contract and identity integrations
- Hosting
- AWS; EU region not documented
Josys
Overall score: 4.8out of 10Best for: Mid-market IT teams that want SaaS, identity and device management in one console with a free trial.
Josys finds apps and accounts through IdP integrations (Microsoft, Google, Okta), activity signals and a browser extension, with app risk scores “powered by Netskope”. It adds zero-touch offboarding, access reviews, device management through Intune and leaked-credential monitoring. Pricing is custom, but a 14-day trial needs no credit card.[15]
- Discovery without agents
- 6.0
- Historical discovery
- 4.0
- OAuth visibility and revocation
- 5.0
- Also stops phishing
- 1.0
- Published price for lean IT
- 5.0
- EU hosting documented
- 4.0
- SaaS governance breadth
- 8.0
Pros
- Self-serve 14-day trial
- SOC 2 Type 2 and ISO 27001 (vendor)
- Multi-tenant portal for MSPs
Cons
- No phishing protection
- No public prices
- EU hosting not documented
- Pricing
- Custom, based on identities governed; 14-day free trial
- Deployment
- IdP integration plus optional browser extension
- Platforms
- Okta, Microsoft Entra ID, Google Workspace; Intune for devices
- Hosting
- Not documented
Zylo
Overall score: 4.7out of 10Best for: Enterprises whose shadow IT problem is mostly spend: expensed SaaS and AI and renewals.
Zylo discovers applications from financial, identity and operational systems, including accounts payable, expense systems, resellers and marketplaces, and matches them with AI models. Its strength is cost: approve, consolidate or eliminate apps, reclaim licenses and manage AI costs. Security controls such as OAuth revocation are not its focus.[16]
- Discovery without agents
- 7.0
- Historical discovery
- 5.0
- OAuth visibility and revocation
- 4.0
- Also stops phishing
- 1.0
- Published price for lean IT
- 3.0
- EU hosting documented
- 4.0
- SaaS governance breadth
- 8.0
Pros
- Finds expensed apps that SSO never sees
- Large spend dataset for benchmarks (vendor)
- AI cost management
Cons
- Security controls are not the focus
- No public prices
- EU hosting not documented
- Pricing
- Quote only (Core, Premium, Enterprise)
- Deployment
- API integrations to finance, identity and usage sources
- Platforms
- Okta, Entra; accounts payable and expense systems
- Hosting
- Not documented
Zluri
Overall score: 4.5out of 10Best for: IT teams that want shadow IT discovery inside an identity governance and access review program.
Zluri’s discovery engine scans SSO, MDM, CASB and local devices to find apps, including those outside SSO, and classifies them into 50+ categories. It bundles identity governance, access reviews and automated deprovisioning. Zluri was acquired by Infotech (formerly Info-Tech Research Group) on 14 October 2026 and runs as a standalone division.[13]
- Discovery without agents
- 4.0
- Historical discovery
- 5.0
- OAuth visibility and revocation
- 5.0
- Also stops phishing
- 1.0
- Published price for lean IT
- 3.0
- EU hosting documented
- 4.0
- SaaS governance breadth
- 9.0
Pros
- Identity governance and SaaS management in one
- Discovery beyond SSO
- Long certification list (vendor)
Cons
- Device-level discovery adds deployment work
- No public prices
- New owner since October 2026
- Pricing
- Not published
- Deployment
- API, SSO and MDM integrations plus device-level discovery
- Platforms
- Google Workspace, IdP/SSO integrations
- Hosting
- AWS; EU residency not documented
How to choose a shadow IT discovery tool
Start with how the tool sees apps
Every tool on this list answers the same question, which apps are people using, from a different vantage point. That vantage point decides what you see, what you miss and how much rollout work you take on. A lean IT team should pick the method first and the vendor second.
| Discovery method | Sees well | Misses or costs | Tools |
|---|---|---|---|
| Mailbox data and OAuth grants (API) | Signups, welcome mails, receipts, OAuth consents, history before deployment | Apps that never email or request a grant | Sentaro, Nudge Security, Grip Security |
| Browser extension | Logins, login method, consents, in-browser AI use | Unmanaged browsers and devices; needs MDM rollout | Push Security, Josys, Torii (in part) |
| Network or proxy logs | All traffic through the corporate edge | Off-network devices without an agent; apps not in the catalog | Microsoft Defender for Cloud Apps, Zluri (via CASB) |
| Finance and expense data | Paid and expensed apps, renewals | Free tiers and trials | Zylo, Torii |
Treat shadow IT as an attack surface, not only a spreadsheet
Most shadow IT is harmless productivity software. The dangerous part is the OAuth grant: an app with read access to a mailbox or drive keeps that access after a password reset. Consent phishing exploits exactly this, by tricking a user into approving a malicious or lookalike app, often one that impersonates a known AI tool. That is why this method weights OAuth revocation and phishing protection highly: an inventory that cannot remove a risky grant, or stop the email that asks for it, leaves the risk where it was.
Count the tools you will run, not just the features
A SaaS management platform plus an email security product is two contracts, two consoles and two sets of alerts. For a team of one to five people that cost is real. Sentaro’s approach is to put app discovery and inbox protection in one API connection and one price; dedicated platforms such as Nudge Security, Torii or Zylo go deeper on spend and lifecycle and expect you to run email security next to them.
Check ownership before you sign
This category consolidated fast in 2025 and 2026. Zluri was acquired by Infotech (October 2026), Torii signed to be acquired by Freshworks (October 2026, pending), BetterCloud was acquired by CoreStack (March 2026), Trelica became 1Password SaaS Manager (January 2025), and DoControl was acquired by Spin.AI (August 2026). An acquisition is not a reason to avoid a product, but ask about roadmap, pricing and data-processing changes during the contract.
Questions to ask every vendor
- What exactly do you read: email metadata, email content, OAuth grants, browser activity or network logs?
- Do you show apps adopted before we connected, and how far back?
- Can you revoke a risky OAuth grant from your console, or only flag it?
- What happens to the phishing email that asks for the grant?
- Do we need an agent or extension on every device, including contractors?
- Where is our app inventory stored, and which subprocessors process it?
- What is the total price for our headcount, in writing, without a sales call?
Also considered
We also looked at 1Password SaaS Manager (formerly Trelica), which discovers apps from password-vault, IdP, finance and browser-extension signals and suits existing 1Password customers, BetterCloud, now owned by CoreStack and strongest at user-lifecycle automation, and CloudEagle.ai, a procurement-led platform. None publishes a price, and none offers email protection.
Why discovery now includes AI tools
Certification and compliance status
Where Sentaro’s own assurance stands today, in the words Sentaro uses.
- SOC 2
- In progressEvidence pack on request.
- ISO 27001
- In progressSentaro says it will announce it the day it is signed, and not before.
- Google CASA
- Verified API integration
- DPA and subprocessor list
- Public
Frequently asked questions
What is the best shadow IT discovery tool?
Sentaro, for EU teams on Microsoft 365 and Google Workspace. It discovers every app, AI tool and OAuth grant from mailbox data and the tenant’s grants without agents, shows historical adoption within 15 minutes, revokes risky grants in one click, and also blocks phishing and consent phishing in the inbox, at $6 per protected account per month. If you need spend management and offboarding, Nudge Security or Torii go deeper on governance.
What is shadow IT?
Shadow IT is software, SaaS and AI tools that employees use for work without IT’s approval. Most of it is ordinary productivity software. The risk comes from company data stored in unknown places and from OAuth grants that give third-party apps standing access to mail, calendars and files.
How do shadow IT discovery tools find apps?
From one or more of four sources: mailbox data and OAuth grants read over API (Sentaro, Nudge Security, Grip Security), a browser extension (Push Security, Josys), network or proxy logs (Microsoft Defender for Cloud Apps), and finance and expense data (Zylo, Torii). API-based methods need no rollout to devices and can see history; browser and network methods see activity that never touches email.
Can I discover shadow IT without installing agents?
Yes. Sentaro, Nudge Security and Grip Security connect over API to Microsoft 365 or Google Workspace and read email and identity signals, so nothing is installed on laptops or browsers. Sentaro connects in four minutes with no agents and no MX change. Browser-extension and proxy-based tools need deployment to every device.
Does Microsoft 365 include shadow IT discovery?
Microsoft Defender for Cloud Apps provides Cloud Discovery and OAuth app governance. It is included in Microsoft 365 E5 and EMS E5 and in the Microsoft Defender Suite ($12 per user per month, requires E3), according to Microsoft. Discovery uses Defender for Endpoint, a log collector or a proxy integration. Admins on other plans can review OAuth grants by hand in Microsoft Entra.
What is the difference between shadow IT discovery and SaaS management?
Discovery answers which apps exist and who uses them. SaaS management platforms such as Torii, Zylo and Zluri add spend tracking, license reclamation, renewals, access reviews and offboarding. Security-focused tools such as Sentaro and Push Security add risk scoring, OAuth revocation and phishing protection. Many lean teams need discovery and security first.
Is it a problem that so many shadow IT vendors were acquired?
Not by itself, but check it. In 2026 Zluri was acquired by Infotech, BetterCloud by CoreStack and DoControl by Spin.AI, and Torii signed an agreement to be acquired by Freshworks. Ask each vendor whether pricing, roadmap, hosting or subprocessors will change, and get the answer into the contract.
Sources and method
Sentaro publishes this list and ranks itself first; scores use the method above and public vendor documentation as of 21 October 2026. Product capabilities, prices and ownership change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.
- Sentaro: pricing
- Sentaro: Data Processing Agreement and subprocessor list
- Nudge Security: pricing (accessed 2026-10-21)
- Nudge Security: product overview (accessed 2026-10-21)
- Push Security: pricing, deployment, EU storage and certifications (accessed 2026-10-21)
- Grip Security: pricing (accessed 2026-10-21)
- Grip Security: platform (accessed 2026-10-21)
- Microsoft: Defender for Cloud Apps product and pricing page (accessed 2026-10-21)
- Microsoft Learn: Discover and manage shadow IT (Defender for Cloud Apps) (accessed 2026-10-21)
- Microsoft Learn: Defender for Cloud Apps data storage location (accessed 2026-10-21)
- Torii: home page, discovery sources and certifications (accessed 2026-10-21)
- Torii: definitive agreement to be acquired by Freshworks (12 October 2026)
- Zluri: Monitor shadow IT (accessed 2026-10-21)
- Inc42: Infotech acquires Zluri (14 October 2026)
- Josys: pricing, discovery sources and certifications (accessed 2026-10-21)
- Zylo: shadow IT discovery (accessed 2026-10-21)
- Zylo: pricing (accessed 2026-10-21)
- BetterCloud: CoreStack acquires BetterCloud (31 March 2026)
- 1Password: SaaS Manager (formerly Trelica) (accessed 2026-10-21)
- Verizon Data Breach Investigations Report 2026 (as cited by Sentaro)
- Spin.AI: Spin.AI acquires DoControl (31 August 2026)
- o365hq: Defender for Cloud Apps licensing, standalone vs E5 vs Defender Suite (third-party)