Abstract: A computing system for detecting shadow applications operating in devices used by an organization, the system including a memory and a processor configured to monitor incoming email messages received by email accounts of the organization, identify, from the incoming email messages, a first list of software services used by identities of the organization, collect from identity provider services a second list of software services used by identities of the organization via the identity provider services, identify a list of unsanctioned applications that appear in the first list and do not appear in the second list of software services, and update a database based on the list of unsanctioned applications.

Abstract: A computer implemented method for securing at least one of files and records related to a specific process, the method comprising obtaining interaction data comprising one or more persons and one or more files and/or records, said interaction data comprises a process interaction score between at least one user and the specific process; identifying, from the interaction data, one or more persons and one or more files and/or records related to the specific process; comparing a process threshold with a process interaction score between a target user and the specific process; and in response to the comparison satisfying a rule, performing a security operation on the one or more files and/or records related to the specific process.