The CASB report indicates several unsanctioned SaaS applications are being used in an organization. Which of the following is the MOST likely cause?

VPN bypass might be a method of accessing unsanctioned applications but is not the underlying cause of their adoption within the organization.

Shadow IT refers to IT systems and solutions built and used within organizations without explicit organizational approval, leading directly to the adoption of unsanctioned SaaS applications that a CASB would detect. This practice bypasses official procurement and security processes.

Web proxy bypass is a technical means to circumvent controls, but it is a symptom or method, not the fundamental reason why users initially adopted unsanctioned services.

CAB (Change Advisory Board) approval is a formal process for managing changes; its absence or failure to obtain approval is a characteristic of Shadow IT, but 'CAB approval' itself is not the cause of unsanctioned app usage.