Shadow IT under control.
Every month, with no spreadsheet.

It is any software used in the company without going through IT and security approval: a tool one team contracted on its own, a free app used with a personal email or a SaaS product that came in on a corporate card. The risk is having company data somewhere nobody controls, with no SSO, no MFA and no access review.

It is the Shadow IT of artificial intelligence tools: assistants, code generators and chatbots used without approval, often with a personal account. In Niuco, these tools join the same inventory as the other software, with stage, owner, risk score and access review.

Resolution 4,893 applies to banks, credit unions and other financial institutions authorized by the Central Bank of Brazil. It requires a cybersecurity policy and sets requirements for contracting relevant data processing, data storage and cloud computing services. With CMN Resolution No. 5,274/2025, it detailed the minimum controls, such as authentication, access control (including the periodic review of permissions) and traceability; the compliance deadline ended on March 1, 2026. Payment institutions, brokerages, securities dealers, foreign exchange brokers and virtual asset service providers follow equivalent rules in BCB Resolution No. 85/2021, amended by BCB Resolution No. 538/2025. In practice, meeting these controls is hard without knowing which services are in use, who has access to each one and what was decided — and that is what Niuco organizes. Informational content, not legal advice: using Niuco does not, on its own, guarantee compliance; assess the requirements with your legal and compliance teams.

By cross-referencing the sources the institution already has: SSO login with Google and Microsoft, audit logs, the apps installed in messaging tools such as Slack, the procurement platform and Netskope web traffic. Each new piece of software enters the inventory with the date it appeared and with its SSO, MFA and local account posture. Niuco AI suggests the category, the data in use and the risk score for each one, and you review and approve the suggestions.

Yes. Niuco integrates with your web filter (SWG), such as Netskope: when a piece of software is marked as prohibited in Niuco, it is blocked at the proxy, with no ticket for the infrastructure team. If it is approved later, access comes back. In Niuco you can also remove or deactivate the users of that software, with approval and history.

No. Niuco connects to what you already have, such as Netskope, Microsoft Entra ID, Google Workspace and Slack, and organizes discovery, approval and access review in a single place.

With an assessment: we understand the current process, the available sources and what the risk committee needs to see. We then connect the sources and run a POC guided by your software and risk criteria, before any contract.