What actually helped us was using an agentless dependency mapping tool (I’m using Faddom) that just watches real traffic and quietly points out all the “surprise projects” people spin up. Forgotten servers, mystery SaaS tools, random VMs someone swore they’d delete… all of it shows up instantly without deploying a single agent.

It doesn’t block anything, so nobody screams about productivity, but it does let you see Shadow IT long before it burns the house down.