Shadow cloud is cloud infrastructure that your organization runs, but that the security team does not know about. A developer opens a personal AWS account for a demo and points a company subdomain at it. An agency builds a campaign site on its own cloud account. None of this goes through your cloud inventory, so none of it gets your security controls.
Your cloud consoles cannot show it. They only show the accounts you already know. Finding shadow cloud takes two lists. The first is what you own: the resources in the accounts you know about. The second is what the internet sees under your name: every hostname and IP address under your domains. Anything cloud-hosted on the second list that is missing from the first needs an explanation. Most of it will turn out to be an account you have not connected yet, or an address that is not yours at all. What is left after those two is shadow cloud. Vulmon Recon builds both lists, shows you the difference, and gives you a place to record the explanation.
Step one: connect the accounts you know
Recon connects to AWS, GCP, Azure and Cloudflare with read-only access. For AWS you create a role with a read-only policy and an External ID. For GCP you grant a read-only role and set a project label. For Azure you assign the built-in Reader role and set a subscription tag. For Cloudflare you create a scoped read-only API token. Each wizard shows the exact values to paste. Nothing is installed, and nothing in your account changes. The setup guide has the details.
Enumeration starts as soon as you connect. Recon lists the externally exposed resources in the account: compute instances with public addresses, load balancers, public IPs, DNS zones, CDNs, publicly reachable storage buckets and more, fourteen resource types in all. Each one shows its provider, type, service, region, account and whether it is public. The exposed ones are brought into monitoring automatically, up to your plan’s asset limit. Every domain and IP address that comes from a connected account is tied back to its cloud resource, account and region. When an instance changes its address or is terminated, the inventory follows. Public buckets are flagged.
This is your first list, and it is the reference. It also answers a quieter question: what the accounts you do know about expose, down to the public address.
Step two: let Recon look from the outside
Discovery starts from your root domains and finds the hostnames and IP addresses under them, the way an attacker would. Cloud-hosted ones are matched to their provider. Then Recon compares the two lists. Every IP address at a major cloud provider that is not attributed to any connected account is counted, with the provider named. On the Cloud resources tab this appears as cloud-hosted assets outside your connected accounts, with a count per provider. Hostnames that point at cloud services, such as a CDN, a hosted application platform or storage, are labeled in the domain inventory as well.
That count is not a verdict. It is your review list. An address is on it for one of three reasons. The account is yours, but nobody has connected it yet. The address is not yours, for example a hostname of yours that points at a vendor’s machine or at a shared service. Or the account is one that nobody in the company told you about. Only the last one is shadow cloud, and the product cannot tell the three apart. You can, with the evidence Recon puts next to each address.
It works before you connect anything too. Every cloud-hosted IP Recon finds shows up in your scope review with the provider named, and you decide which ones are yours. Connecting your accounts is what turns that review into a short list.
Working through the review list
- An account of yours that nobody connected. The most common case. Connect it with read-only access, and its addresses drop off the list.
- Not yours. A vendor or an agency hosts it for you, or your hostname points at a shared service. Mark it out of scope and write the vendor’s name as its purpose. It stays visible and documented, because the hostname still carries your name.
- A dangling record. The DNS record points to a cloud resource that no longer exists. Anyone who claims that resource can serve content under your domain. This is a subdomain takeover risk. Fix these first.
- An account nobody knew about. What remains when the other three are cleared. This is shadow cloud. Someone in the company runs it, and now you know. Bring it under management, or shut it down.
One caution. Knowing which provider hosts an address does not tell you which account owns it. Ownership comes from your own records, from the evidence on the asset, and from asking people.
Step three: write down what each asset is
Finding an asset is half the work. The other half is being able to say what it is. Recon’s Asset review is where that happens. Every domain and IP address, and every port on an IP, can carry a written asset purpose and an owner. A documentation health bar shows how far you are: documented versus total, with shortcuts to the assets still missing a purpose or still waiting for a scope decision.
The addresses nobody can write a purpose for are the ones to chase. Everything else gets a name and an owner, or gets marked out of scope, and stops being a question.
The same record does the compliance work. ISO/IEC 27001 control A.5.9 asks for an inventory of assets with owners, maintained over time. PCI DSS 4.0 requirement 12.5.1 asks for an inventory of in-scope system components with a description of their function or use, kept current. Recon’s asset inventory report lists every in-scope domain, IP address and monitored cloud resource with its documented purpose, and the attestation reports map the same inventory to ISO/IEC 27001, PCI DSS, DORA, BDDK and BİGR. The CSV export carries the owner and the purpose too, and earlier versions of a purpose are kept.
Closing the gap
- Find the owner. The WHOIS record, the certificate subject and the page content usually point to a team or a vendor. Recon shows all three on the asset.
- Connect the account, or mark it out of scope. Read-only access is enough. Once an account is connected, its resources join the inventory, each asset is tied back to its resource, account and region, and the review list gets shorter. A third party you have confirmed can be marked out of scope.
- Write the purpose. Give every asset that stays a purpose and an owner. The documentation bar tells you when you are done.
- Add every root domain you own, including old brands and country domains. Shadow cloud hides under the domains nobody watches.
- Keep it running. New accounts show up as new assets, and Recon notifies you when a new asset appears. The review list becomes something you watch, not a project you run once.
Try it on your own domains
Request a trial, add your domains and connect one account. Trials run for 14 days with the full product and no card on file. If you are new to Recon, start with the introduction.