> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/risk-snapshot.md).

# Risk snapshot

To facilitate the decision-making process about whether to allow an app to operate in your organization or not, DoControl provides you with a comprehensive and reliable risk snapshot for each app:

* [App and company data](#app-and-company-data)
* [Marketplace data](#marketplace-data)
* [Permissions and scopes](#permissions-and-scopes)
* [Risk elements](#risk-elements)
* [App activity](#app-activity)

#### Inspect risk snapshot:

1. To gain more data insights about a specific shadow app, click the **App name** link. 
2. DoControl displays a drawer with enrichment data for each shadow app:

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2F3SJluDlvoN262hr8txud%2Fapp%20drawers.png?alt=media&amp;token=7614e2a5-db2a-40dc-b9e0-183405622052" alt=""><figcaption><p>Clicking each app name opens a drawer with enrichment data</p></figcaption></figure>

For each risk snapshot, DoControl summarizes the main highlights:

<table><thead><tr><th width="229">Risk snapshot summary</th><th>Description</th></tr></thead><tbody><tr><td>Last update</td><td>Date when risk snapshot was last updated.</td></tr><tr><td>App status</td><td><p>If the app is currently installed in your organization:</p><ul><li><strong>Installed</strong> - App is installed in your organization.</li><li><strong>Reinstalled</strong> - After the app was removed, user reinstalled the app.</li><li><strong>Not installed</strong> - App was removed by a user.</li><li><strong>Removed</strong> - App was removed by DoControl.</li></ul></td></tr><tr><td>App ID</td><td>Shadow app ID. Click the <strong>Copy</strong> icon to copy the app ID.</td></tr><tr><td>Origin</td><td>Where the shadow app originates from, for example, third party</td></tr><tr><td>Risk score</td><td>Score from 1-10 that evaluates how risky the shadow app is in your organization.</td></tr><tr><td>Classification status</td><td><p>Manually change the classification status to:</p><ul><li>Sanctioned (allowed)</li><li>Unsanctioned (disallowed)</li><li>Banned (risky and disallowed)</li></ul></td></tr><tr><td>Remediate</td><td><p>Select an inventory action from the dropdown:</p><p><a href="/docontrol-user-guide/workflows/define-workflow-settings/action-settings/remediate/google-workspace-remediation.md#remove-app">Remove app</a></p></td></tr><tr><td>View users</td><td>Displays data about users who have installed or are using a specific shadow app.</td></tr><tr><td>Data feedback</td><td>Provide data feedback about shadow apps to help us improve our app risk scoring, and general app data.</td></tr></tbody></table>

## App and company data

DoControl displays enriched information about the app, company and publisher. This data can offer insights about the company's business category, reputation, and compliance support, as well as links to the company's website and social media pages.

App and company data for each shadow app is displayed as follows:

<div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2Fcs5dHClOn19E6GcMWgqy%2Fapp%20company%20data%20Golden.png?alt=media&amp;token=2a5204c8-f103-4214-8365-07d0b6f4327d" alt=""><figcaption><p>The App and company data card offers insights about the app, company and publisher</p></figcaption></figure></div>

<table><thead><tr><th width="271.5">App and company data card</th><th>Description</th></tr></thead><tbody><tr><td>App ID</td><td>Unique ID of the app. Click the <strong>Copy</strong> icon to copy the app ID.</td></tr><tr><td>App origin</td><td>Where the shadow app originates from, for example, third party.</td></tr><tr><td>App publisher email</td><td>The email address of the app publisher. Click the <strong>Copy</strong> icon to copy the app publisher email.</td></tr><tr><td>App category</td><td>Functional area of the shadow app; for example, productivity, communication, financial services.</td></tr><tr><td>Company name</td><td>Name of company that publishes the app.</td></tr><tr><td>Description</td><td>Summary of the company and app.</td></tr><tr><td>Contact email</td><td>Email address of the company. Click the <strong>Copy</strong> icon to copy the contact email.</td></tr><tr><td>Location</td><td>Cities and states where company is based.</td></tr><tr><td>Founded date</td><td>Date when company was established.</td></tr><tr><td>Industries</td><td>Business sectors in the company's target audience.</td></tr><tr><td>Official website</td><td>Website of the company publishing the app. Click the link to open the URL.</td></tr><tr><td>Knowledge page</td><td>Click the link to open the company's page in a third-party open knowledge base.</td></tr><tr><td>Compliance</td><td>Standards that the shadow app publisher is compliant with, for example, GDPR or SOC2.</td></tr><tr><td>Number of employees</td><td>Company headcount</td></tr><tr><td>Social media links</td><td>View the company's social media page in various apps, such as Twitter, LinkedIn, GitHub.</td></tr></tbody></table>

## Marketplace data

DoControl displays app data gleaned from Google Marketplace, the site for all third-party apps integrated with Google Workspace.

<div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FTlBHM8KQWQkhY2I4JGQd%2Fmarketplace%20data.png?alt=media&amp;token=448647d5-ac58-4fcd-afd9-916fa5d40c7f" alt=""><figcaption></figcaption></figure></div>

<table><thead><tr><th width="257.5">Marketplace card</th><th>Description</th></tr></thead><tbody><tr><td>Description</td><td>Summary on Marketplace describing the app's functionality.</td></tr><tr><td>Marketplace</td><td>URL link to app on Google Marketplace. Click the <strong>Copy</strong> icon to copy the URL.</td></tr><tr><td>Listing updated</td><td>Date when the app was last updated on Marketplace.</td></tr><tr><td>Rating</td><td>Performance rating out of 5 stars with number of votes.</td></tr></tbody></table>

## Permissions and scopes

DoControl displays the permissions and scopes for each shadow app that's installed on your organizational cloud. The permission level indicates to what extent these permissions are intrusive (low, medium, or high).&#x20;

<div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2Fzes0Epo6Y6YfKbmrO2cL%2Fpermissions%20and%20scopes.png?alt=media&amp;token=2693a8d9-fd99-4fcd-80f3-4b5166737589" alt=""><figcaption></figcaption></figure></div>

Each scope is associated with a specific API running on the SaaS platform (such as Google Workspace).

The various permission levels include:

* **Low** - Scopes without any interaction with the platform; for example, login activities.
* **Medium** - Scopes that require read-only permission.
* **High** - Scopes that require write, edit or delete permission. &#x20;

{% hint style="info" %}
Most organizations implement a least privileged principle, whereby bare minimum permissions are allocated to only those users who need them. Too many write permissions increase the attack surface across your SaaS platform.
{% endhint %}

Hover over the API name to view a description of the associated permissions, for example:

* `drive` - See, edit, create, and delete all of your Google Drive files
* `drive.photos.readonly` - View the photos, videos and albums in your Google Photos

## Risk elements

The risk score is DoControl’s calculated risk score to evaluate how risky a specific app is in your organization. The score ranges from 1-10, where 1 indicates the least risky, and 10 indicates the most risky.&#x20;

DoControl fuses multiple risk factors into a single cohesive exposure score. The risk score takes various factors into account, including usage, permission levels, marketplace approvals, origin and many other factors.&#x20;

The app risk score helps you to prioritize critical findings, and accelerate your handling and decision making when it comes to permitting a specific shadow app or not.

<div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FiAc7kuMAfFEXQJY2oQrS%2Frisk%20elements.png?alt=media&amp;token=8bc3c6de-8063-4307-909a-242256adfb16" alt=""><figcaption><p>Breakdown of the risk factors that contribute to the total risk score for a shadow app</p></figcaption></figure></div>

The total risk score for a shadow app is made up of risk elements, which are all displayed in the shadow app's Risk card:

<table><thead><tr><th width="199">Risk element</th><th width="352.3333333333333">Description</th><th>Weight on risk score</th></tr></thead><tbody><tr><td>Platform app</td><td>App was developed by the SaaS platform, where publisher email ends with a google.com or similar domain. This element sets the risk score to an <strong>absolute value of 1</strong>.</td><td>1</td></tr><tr><td>App or publisher name is misleading</td><td>App name includes homographic characters, typically used to impersonate another app. This element sets the risk score to an <strong>absolute value of 10</strong>.</td><td>10</td></tr><tr><td>Google verified app</td><td>App is verified by Google workspace.</td><td>-3</td></tr><tr><td>First-party app</td><td>App was published by a first-party vendor or trusted domain.</td><td>-3</td></tr><tr><td>Internal app</td><td>App was published by someone in your organization.</td><td>-5</td></tr><tr><td>Legacy app</td><td>All scopes used by the app to access the SaaS platform are deprecated.</td><td>+3</td></tr><tr><td>Has legacy scopes</td><td>Some of the scopes used by the app to access the SaaS platform are deprecated.</td><td>+1</td></tr><tr><td>Publisher registered with private email</td><td>The app publisher registered with a private email account, instead of a company email account.</td><td>+2</td></tr><tr><td>Reviewed by DoControl</td><td>App was analyzed by DoControl and seems safe for use.</td><td>-3</td></tr><tr><td>Extensive data permissions</td><td>App scopes include high-impact permissions which could cause damage if misused.</td><td>0</td></tr><tr><td>Has manage scopes</td><td>App scopes include permission to manage app configurations.</td><td>0</td></tr><tr><td>Has edit or delete scopes</td><td>App scopes include permission to edit or delete your organization's data.</td><td>0</td></tr><tr><td>Has view scopes</td><td>App scopes include permission to view your organization's data and documents.</td><td>0</td></tr><tr><td>Unverified app</td><td>App was not verified by Google Workspace.</td><td>0</td></tr></tbody></table>

## App activity

The App activity card is visible only for apps with **access rights**. It's not displayed for sign-in only apps. App activity includes API calls and IP addresses.

### API calls

{% hint style="warning" %}
API calls are not displayed for unused apps (where usage=none).
{% endhint %}

App activity provides insights into how each shadow app behaves in your organization:

* What are the API calls the app performs and what is their breakdown?
* Are they **Read** or **Write** operations? Are these calls intrusive?

<div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FG1m7FQFPENpmO3F5Zcp2%2Fappdrawer3.png?alt=media&amp;token=1ef7731b-a806-46f8-92d3-a37d1ade5e36" alt=""><figcaption><p>The App activity card gives insights into type of API calls and origin of IP addresses</p></figcaption></figure></div>

#### To gain insight into API calls:

* Hover over the doughnut graph to view the percentage of API calls for a specific API.

### IP addresses

You can inspect the IP addresses of the app servers per region. DoControl checks the validity of an IP address via a threat intelligence platform (TIP), such as VirusTotal, and indicates its risk level accordingly. &#x20;

{% hint style="warning" %}
If an IP address originates from a suspicious or malicious region or country, it raises the risk level of the app.
{% endhint %}

IP address parameters include the following: &#x20;

<table><thead><tr><th width="215">IP address parameter</th><th>Description</th></tr></thead><tbody><tr><td>IP</td><td>IP address of the app server.</td></tr><tr><td>Provider</td><td>Name of provider for the app server.</td></tr><tr><td>Last activity</td><td>Date the server was last active.</td></tr><tr><td>Usage</td><td>Percentage that a specific server is used.</td></tr><tr><td>Detect</td><td><p>Click the VirusTotal link to view the threat level of the IP address, as indicated by one of these levels:</p><ul><li>Harmless</li><li>Suspicious</li><li>Malicious</li></ul></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps/risk-snapshot.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.