Abstract: A method, system and computer-usable medium for performing a shadow information technology discover operation, comprising: monitoring interactions initiated via an endpoint device; determining when the interactions comprise a cloud services request, the cloud services request comprising a request by a user to access a cloud service; monitoring interactions between the user and the cloud service when a request to access the cloud service is detected; determining whether the interactions between the user and the cloud service represent a non-authorized use of the cloud service; and, managing risk associated with non-authorized use of the cloud service.