Last verified April 2026
Category 2: Breach exposure
Probabilistic Breach Exposure: Estimating Shadow IT Security Risk
Annualized loss expectancy applied to shadow IT. The inputs: breach cost from IBM's public benchmark, probability from your threat model or insurance, and a shadow-IT attribution assumption stated openly rather than hidden in an invented number.
Definition and formula
Annualized loss expectancy, adapted for shadow IT: ALE = breach probability x breach cost x shadow-IT attribution. The product is your estimated annual expected loss attributable to shadow-IT-related breach exposure. The formula is standard risk management; the adaptation is splitting the probability into 'overall breach probability' (for which public data exists) and 'shadow-IT attribution' (for which you must disclose an explicit assumption).
Sourcing each input
Breach cost. IBM's Cost of a Data Breach report IBM Cost of a Data Breach Report 2024 (research conducted by Ponemon Institute) (2024) Measures: Average total cost of a data breach across surveyed organizations globally, by industry, region, and breach attribute. Methodology: Annual study by Ponemon Institute, sponsored by IBM. Activity-based costing across roughly 600 organizations that experienced a breach in the prior year. Methodology disclosed in the report appendix. Trust: Primary research, peer-reviewed or officialIBM CODB
Breach probability. Three defensible sources. (1) Your cyber insurance carrier's actuarial rate from your quote materials. (2) Your organization's threat model output if you maintain one. (3) A threat-model estimate anchored by Verizon DBIR Verizon Data Breach Investigations Report 2024 (2024) Measures: Confirmed data breaches and security incidents analysed across thousands of organizations, with breach pattern, action, and asset breakdowns. Methodology: Aggregated incident data from Verizon and 80-plus contributing organizations including law enforcement and CSIRTs. Methodology disclosed in the report. Counts incidents and breaches; not a cost study. Trust: Primary research, peer-reviewed or officialVerizon DBIR
Shadow-IT attribution. This is the hardest input to source and the one most often skipped. There is no public benchmark for what fraction of breach probability is specifically attributable to shadow IT because the counterfactual (what the probability would be without shadow IT) is not measured in any primary research. State your assumption explicitly. Common defensible ranges are 10 to 30 percent of total breach probability for organizations with meaningful shadow IT exposure. Run sensitivity analysis across that range rather than picking a single point.
Worked calculation
Inputs for an illustrative 1,000-employee mid-market financial services firm: breach cost (industry average): $6.08 million (IBM 2024 financial services); breach probability: 10 percent per year (carrier-quoted actuarial rate); shadow-IT attribution: 15 percent (labelled assumption, centre of the 10 to 30 percent typical range).
ALE = $6.08M x 10 percent x 15 percent = $91,200. Low-bound (probability 5 percent, attribution 10 percent): $30,400. High-bound (probability 20 percent, attribution 30 percent): $364,800. Report the expected value with the range visible.
How shadow IT actually contributes to breach probability
The usual channels, in rough priority order. Credential reuse: shadow apps with no SSO often lead to work-email credentials reused across unmanaged apps, amplifying the impact of any credential compromise. Data in unmanaged apps: regulated or confidential data ends up in apps without DLP, with no backup, and with unclear data retention. Offboarding gaps: employees leave with access to shadow apps that IT never had on the offboarding checklist, creating lingering access. Third-party processor chains: shadow SaaS often sub-processes further vendors; each additional processor is a breach pathway.
None of these are quantified in peer-reviewed literature with attribution percentages. They are operational narratives that justify the range 10 to 30 percent as plausible rather than a narrower or wider range. The sensitivity analysis across that range is where the board conversation actually happens.
Common mistakes to avoid
Quoting $4.88 million (or similar IBM global average) as 'what shadow IT costs' without multiplying by probability and attribution. That overstates by an order of magnitude. Claiming a specific attribution percentage (for example 'shadow IT causes 35 percent of breaches') without labelling it as an assumption; that is not supported by primary research. Using a vendor-published breach premium figure as if it were a measurement of shadow IT specifically; vendor content often paraphrases IBM's findings in ways that lose the methodology.
The defensible framing
IBM's figure is the public cost benchmark for a breach. Your expected annual shadow-IT-attributable breach loss is IBM industry figure times your annual breach probability times your explicitly-disclosed shadow-IT attribution percentage. All three inputs are cited or labelled as assumptions. The output is a bounded estimate, not a forecast.
Category 1
Observable spend ->
Category 3
Compliance ->
Reference
Statistics ledger ->