The problem in plain language
A team starts a free or low-friction software trial to solve an immediate problem. Before anyone makes a formal production decision, colleagues are invited, data is loaded, integrations are connected, reports are shared or customers begin depending on the workflow. The trial has quietly become operational infrastructure.
Nobody intended this. The tool worked, it solved a real need and nobody had a reason to stop using it. The problem surfaces later: when the trial expires, when a payment card is declined, when the person who set it up leaves, or when someone asks where a particular customer file is kept.
What the buyer is actually trying to solve
The buyer needs to know when experimentation crosses into production dependency, and how to bring that software under normal ownership, security, commercial and lifecycle controls before the trial expires or the original maker disappears.
Search language tends to be practical: "how to find unapproved SaaS", "shadow IT discovery", "free trial expired and we lost our data", "SaaS sprawl" or "who owns this software". These are different descriptions of the same missing threshold.
Evidence and system mechanism
CIS Control 2 calls for organisations to actively inventory and manage software assets so that authorised software is known and unmanaged or unauthorised software can be found. Its software-inventory safeguard asks for the title, publisher, initial install or use date and business purpose of each entry and, where appropriate, details such as the URL, deployment mechanism, decommission date and number of licences, with the inventory reviewed bi-annually or more frequently, according to the CIS Control 2 assessment specification. Those fields matter because software risk changes when an experiment becomes part of real work.
The UK National Cyber Security Centre's guidance on shadow IT describes unknown assets used for business purposes as an unmanaged risk, because they sit outside asset management and corporate processes. It lists project management or planning services used as an alternative to corporate tooling among typical examples, and stresses that shadow IT is rarely malicious: it usually arises when staff struggle to get their work done with sanctioned tools, or when the process for requesting new services is slow or ineffective.
A free trial creates the same dependency problem as any other application once it contains important data, supports a business process, integrates with other systems or becomes necessary for staff to do their work. Price at acquisition does not determine operational criticality.
How a trial crosses the line
Illustrative example: a marketing team starts a trial of an online form builder to collect event registrations. Within a month it is also capturing customer enquiries, a colleague has connected it to the CRM through a no-code connector, and the sales team relies on its notifications. The trial account is registered to one person's email address and paid for, after conversion, on a personal expense claim. None of these steps was a decision to adopt production software. Together they amount to one.
Common crossing points include:
- more than a handful of users are invited;
- customer, employee or financial data is entered;
- an integration, webhook or API key connects it to another system;
- a recurring process or customer-facing commitment depends on it;
- it is paid for on a card or expense claim rather than through procurement.
Problem owner and why now
Application portfolio, IT operations, security and the sponsoring business owner share responsibility. Urgency rises when the trial is about to expire, payment is required, more users are invited, sensitive data is introduced, an integration is added or the workflow becomes difficult to replace without disruption.
Economic consequence
An unmanaged trial can lead to rushed purchasing, duplicated software, migration effort, data-retrieval problems, support ambiguity or service disruption. It can also leave the business paying for a capability it already owns elsewhere, or negotiating a renewal from a position of dependency rather than choice.
The useful evidence is operational: who uses it, what data it holds, which process depends on it, what connects to it, who owns the decision and what would stop if access ended. Do not apply generic percentages. Measure from your own expense, identity and inventory data.
Root cause
The root cause is usually a missing transition from experimentation to production governance. Acquisition is easy, but there is no trigger that says: this tool now matters enough to require an owner, an authorisation decision, a lifecycle record and an exit path.
A slow or heavy approval process can make this worse. If adopting a tool properly takes weeks, teams will keep using it informally. The NCSC recommends an effective and simple process for user requests, and controlled routes for bringing unsanctioned services under management, for exactly this reason.
Practical intervention
- Define criteria for when a trial becomes a production dependency, using crossing points like those above.
- Discover trials and low-friction SaaS through expense, identity, browser, single sign-on and application-inventory signals where appropriate.
- Record business purpose, owner, users, data, integrations and authorisation status.
- Apply a proportionate security check. The NCSC's lightweight approach to cloud security sets minimum expectations for SaaS covering encryption, authentication and access control, security logging and governance, including whether a service supports single sign-on and can enforce two-factor authentication.
- Decide explicitly to adopt, replace, consolidate or retire the tool.
- If adopted, move it into normal support, access, procurement, security and renewal controls, with the account owned by the organisation rather than an individual.
- If retired, plan data export, workflow replacement and dependency removal before access ends.
The trade-off is speed against control. Banning trials pushes experimentation out of sight; ignoring them lets dependencies form unseen. The better balance is a fast, visible route from trial to decision.
Diagnostic questions
- Which trials currently contain operational data?
- Which business processes would stop if a trial ended today?
- Does every production-used tool have a named business owner?
- Is any business-critical account registered to an individual's personal or departing email address?
- Can the organisation export its data and unwind integrations?
- Is the tool already duplicating a capability the business pays for elsewhere?
What good looks like
Teams can experiment quickly, but the organisation has a visible threshold between experimentation and production. Once that threshold is crossed, the application is inventoried, authorised, owned, supported and given a lifecycle decision. Staff report new tools without fear of blame, because the route to approval is quick and the conversation is about dependency rather than rule-breaking.
Where Mellorca fits
Mellorca can help build application discovery and portfolio controls, map SaaS dependencies, rationalise overlapping tools, design lifecycle workflows and establish operational ownership before informal software becomes unmanaged infrastructure. Related reading: why software renewals need a confirmed business owner and why critical low-code automations need support ownership.
Commercial path
A sensible path is: Discovery article, then SaaS and trial discovery, dependency mapping, adopt-or-retire decisions and ongoing portfolio governance. Start with a Digital Systems Audit, explore our solutions or start a conversation.
Method note
CIS and NCSC guidance is used to establish the software-inventory, shadow IT and SaaS assessment mechanisms. It does not state that every free trial becomes production software; this article addresses the narrower condition in which an actual business dependency has formed. The examples are illustrative, not client cases.
Sources and further reading
- CIS Control 2: Inventory and Control of Software Assets (last verified 10 October 2026)
- CIS Control 2: Inventory and Control of Software Assets - CIS Controls Assessment Specification for Controls v8.1 (last verified 10 October 2026)
- Shadow IT guidance (last verified 10 October 2026)
- Lightweight approach to cloud security (last verified 10 October 2026)