Today's cloud applications have resulted in a deluge of non-obvious access to corporate data and resources. Using real-world data from millions of production users, this session will identify a surprising list of applications granted access by users, often with privileged access to sensitive data. We'll show how to assess and reduce this risk with concrete measures in prevention, detection, and remediation.