A monthly charge of a few euros appears on an expense report. The employee has coded it as Office Supplies, which is not a lie, because what they bought was business cards.
It was a subscription to a digital business card app. It holds their name, job title, photograph, direct line and the company logo, and it publishes all of that on a page anyone can reach. It authenticates through a personal email address. Nobody in IT has heard of it, and nobody in IT is going to, because the amount is below every threshold that would cause a human being to look.
This is not a hypothetical. It is the single most common way software enters a large organisation.
A large share of the stack, a sliver of the spend
Zylo, which analyses tens of billions of dollars of company SaaS spend for its annual SaaS Management Index, has found that software bought by individual employees on expense makes up a large share of the average company's applications, close to half in one recent analysis, while accounting for under 4% of its software spend.
That asymmetry is the whole story. A large slice of your software, priced like a rounding error.
Every control a company builds around procurement is triggered by money. Approval thresholds, vendor review, security questionnaires, legal review of terms, a purchase order. All of them are tripped by cost. An eight euro monthly subscription trips none of them, and so it arrives without meeting anyone.
Zylo's 2026 index found that IT directly manages only around 15% of SaaS spend. Business units control most of the rest.
Half of it is filed as something else
The obvious response is to go through the expense reports. That helps less than you would hope.
Zylo estimates that about 51% of expensed software is miscategorised, appearing under headings like Office Supplies or Meals rather than software. So even the finance-led discovery method, which is the one that actually works, is searching a dataset where half the answers have been filed under the wrong letter.
And a digital business card subscription is a particularly well-camouflaged case. It is not miscategorised through carelessness. Under any reasonable reading of an expense policy, business cards genuinely are office supplies. The person coding it is doing their job correctly. The category is just no longer telling anyone the truth about what was bought.
Card tools evade procurement not by hiding, but by being filed honestly under a category that stopped describing them.
What is actually inside it
Strip the branding away and ask what the application holds.
It holds a partial staff directory. Names, job titles, work phone numbers, email addresses, photographs, and by implication the reporting structure of whichever team adopted it. It publishes a subset of that to the open web. In some products it also collects details of the people who scan the card, which is third-party personal data with a different legal regime attached.
Under GDPR none of that is ambiguous. The company is the controller of its employees' personal data. It remains the controller when the processing is happening inside a tool it does not know it is using, purchased by someone without authority to sign a data processing agreement, and authenticated outside single sign-on.
Zylo's data, scored against Netskope's Cloud Confidence Index, found that 59% of expensed apps rate Poor or Low on security risk. That is the population these tools come from.
Why it happened is not mysterious
It is worth saying clearly that nobody did anything wrong here.
A salesperson who is about to attend a trade show needs cards. The internal route takes two weeks, requires a file from someone in brand, and produces a box with an out of date job title on it. An app takes four minutes and costs less than lunch. Then it works, so a colleague asks what they used, and within a quarter there are eleven accounts across three departments and two countries.
Every step in that sequence is a competent person solving a real problem with the fastest tool available. The failure is not individual judgement. It is that the official path was slower than the unofficial one, and the price of the unofficial one sat below the level at which anyone would notice.
What this means for a review
If you are in IT or security at a company of any size, the useful question is not whether this has happened. The base rates make it near certain that it has. The question is how you would find out.
Network monitoring will not see it, because the traffic is ordinary web traffic to an ordinary domain. Identity provider logs will not see it, because the account was never federated. Expense analysis is the method that works, and it is the method the miscategorisation rate degrades.
The most reliable route is usually social. Ask the people who go to trade shows what they use. They will tell you immediately and without embarrassment, because from where they are sitting they did nothing worth concealing.
I work in this category, so take the conclusion with that in mind. The durable fix is not a ban. Bans produce the recidivism rate that SaaS management teams already track, because the underlying need is genuine and does not disappear when the tool does. The fix is that the sanctioned route becomes the fast one, which means it has to issue a card without a ticket, on the first day, without anyone submitting an expense for it.
Until that is true, the tool will keep arriving. It will just keep arriving filed under office supplies.
Want the sanctioned route to be the fast one? Book a demo and see how DBC1 issues a card on an employee's first day, without an expense claim. Details for IT on our page for IT teams.
