Why do organisations struggle to fund identity governance without SaaS management data?

IGA often looks like a cost center because its value is mostly avoided risk, which finance cannot easily book. SaaS management changes the case by tying governance actions to documented savings, such as reclaimed licenses, lower tier assignments, and reduced duplicate subscriptions. When those savings are visible and attributable, the platform can justify itself with measurable spend impact, not only security claims.

Why This Matters for Security Teams

Identity governance is hard to fund when its impact is framed only as avoided breach risk. Finance teams can model reclaimed licenses, reduced duplicate subscriptions, and lower spend faster than they can price “an incident that did not happen.” That is why SaaS management data becomes the bridge: it turns governance work into attributable operational savings while still improving control. NIST’s Cybersecurity Framework 2.0 helps define the control outcome, but it does not create the cost evidence on its own.

NHIMG research shows why the governance case is so often underestimated: only 5.7% of organisations have full visibility into their service accounts, and 71% of NHIs are not rotated within recommended time frames. When the asset picture is incomplete, leaders cannot tie access cleanup to savings, so IGA stays stuck in the “necessary overhead” category instead of being treated like a measurable optimisation program. The cost argument becomes stronger when teams can point to the control failures documented in the Ultimate Guide to NHIs and then show what spend disappeared after remediation. In practice, many security teams encounter funding resistance only after the licence renewals have already gone through.

How It Works in Practice

The practical answer is to connect identity governance actions to SaaS inventory, usage, and entitlement data. That means mapping who has access, what they actually use, which tiers they are assigned to, and whether dormant or duplicate accounts still consume budget. When those signals are joined, the business case shifts from abstract compliance language to documented financial outcomes. The Lifecycle Processes for Managing NHIs section is useful here because the same lifecycle discipline that reduces secrets sprawl also helps reveal unnecessary SaaS access that should be removed or downgraded.

Operationally, teams usually need three layers of evidence:

• Access discovery: identify accounts, entitlements, and stale access across SaaS tools.
• Usage correlation: compare assigned licences and permissions with actual consumption.
• Remediation tracking: record deprovisioning, tier changes, and duplicate removal in a way finance can verify.

That evidence can be aligned with NIST Cybersecurity Framework 2.0 outcomes for access control and asset management, but the value proposition becomes far more persuasive when the security team can show reclaimed spend month over month. NHIMG’s Top 10 NHI Issues also highlights that visibility gaps and excessive privileges are recurring failures, which is exactly why governance programs need inventory-grade data before they can defend their budget. These controls tend to break down in fast-moving SaaS environments where admins can bypass central provisioning and shadow subscriptions are created outside procurement.

Common Variations and Edge Cases

Tighter governance reporting often increases operational overhead, requiring organisations to balance better financial proof against the time needed to collect and reconcile the data. Not every SaaS estate produces clean savings opportunities, and current guidance suggests that some environments will show more risk reduction than direct licence recovery. That is not a failure of the model; it is a sign that the finance case needs to be built around the most measurable controls first.

Edge cases usually appear in three places. First, in high-churn startups, the greatest value may come from rapid offboarding and duplicate-user cleanup rather than tier optimisation. Second, in regulated enterprises, the strongest argument may be audit readiness and entitlement traceability, with savings as a secondary benefit. Third, in organisations with heavy machine-to-machine use, the spend story can be weaker unless governance also covers non-human identities and service accounts, which NHIMG research shows are frequently over-privileged and under-rotated. In those environments, the 52 NHI Breaches Analysis is a reminder that weak identity control is rarely just a security issue; it is also an operational cost problem. Best practice is evolving, but the principle is stable: without attributable usage data, identity governance remains hard to monetise.

Related resources from NHI Mgmt Group

• Why is it important to integrate identity and data governance?
• How should organisations reduce SaaS spend without weakening identity governance?
• How should organisations automate identity lifecycle management without losing governance?
• What is the difference between attack surface management and NHI governance?