Start with a full license audit, then compare purchased seats against real usage and active employees. Remove inactive users, contractors, and former staff whose access is still live, and reassign recovered licenses before buying more. The practical goal is to stop paying for dormant access, keep utilization visible, and make renewals based on evidence rather than assumptions.
Why SaaS waste keeps renewing unless teams measure actual use
SaaS waste usually persists because renewal workflows treat procurement history as proof of value. The control problem is not the invoice itself, it is the gap between what was bought, what is still active, and what employees actually use. Once a subscription auto-renews, that gap becomes a recurring cost rather than a one-time oversight.
Teams should distinguish between licensed capacity, assigned seats, and active usage. A license that is assigned but unused is a cost leak; a license assigned to someone who has left is also an access governance issue because the renewal is masking stale access. In practice, the first pass should identify dormant seats, duplicate tools, and subscriptions with no clear owner.
For organisations that want a sharper baseline, NHIMG’s Ultimate Guide to NHIs notes that only 5.7% of organisations have full visibility into their service accounts. The exact population is different, but the operational lesson transfers cleanly: you cannot reduce waste on assets you cannot reliably see, measure, and attribute.
What to remove, reassign, or challenge before renewal
The most effective cleanup starts with exceptions, not averages. Remove inactive users first, then review contractors and former staff whose access still exists, and finally look at accounts that are technically active but operationally unused. The point is to reclaim seats before buying more, because fresh purchases can hide the fact that existing capacity is already underutilised.
Renewal review should also check whether the subscription is attached to a real business owner and a current use case. If no one can explain why the tool exists, who depends on it, and what would break if it were removed, the renewal decision is too weak. In those cases, teams should force a conscious retain, reduce, or retire decision instead of letting the default renewal stand.
- Confirm the current owner, budget holder, and technical admin for each SaaS product.
- Compare purchased seats with active users over a meaningful usage window, not just last login.
- Reassign recovered seats before approving incremental purchases.
- Escalate subscriptions with no usage evidence or no accountable owner.
For deeper lifecycle cleanup patterns, NHI Lifecycle Management Guide is a useful complement, because the same discipline of discovery, ownership, and offboarding applies when access has drifted beyond its intended life.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS Control 5 — Account Management | Inactive and departed-user cleanup depends on authoritative account inventory and removal. |
| CIS Control 6 — Access Control Management | Seat removal and reassignment are access decisions that reduce excess entitlement. | |
| Recommendation — Review and disable unused SaaS accounts before renewal decisions are approved. Enforce least-privilege SaaS access and reclaim unused seats before purchasing more. | ||
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | Renewal decisions should use evidence of usage and ownership as part of governance. |
| ID.AM-01 — Asset Inventory | Reducing SaaS waste starts with knowing what subscriptions and seats exist. | |
| PR.AA-01 — Identity Management, Authentication and Access Control | Unused SaaS seats often reflect stale access that should be removed or reassigned. | |
| Recommendation — Require usage-based renewal review for SaaS subscriptions under risk management governance. Maintain an accurate SaaS inventory so dormant subscriptions can be identified before auto-renewal. Remove stale user access and confirm each subscription has a current business owner. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding / Lifecycle Management | Auto-renewing SaaS waste often includes stale accounts and forgotten access that should be offboarded. |
| NHI-03 — Excessive Permissions / Overprivilege | Unused seats and lingering access frequently indicate entitlement excess beyond current need. | |
| Recommendation — Offboard inactive and departed users before renewing subscriptions. Reclaim excessive SaaS entitlements and align renewals to actual usage. | ||
Practitioner Guidance
What to prioritise: Start with the renewals that are both high cost and low visibility. Those subscriptions create the fastest savings because a small number of dormant enterprise seats often dominate waste, especially when no one has reviewed usage since procurement.
What to verify: Do not trust “assigned” status as evidence of use. Verify real usage, current employment or contractor status, and whether the account still supports a live business process before deciding to keep it.
Common mistake: Treating cleanup as a one-time cost exercise instead of a repeatable renewal gate. If the renewal calendar is not paired with an ownership review and usage check, the same waste will simply reappear next quarter.
Practitioner takeaway: The goal is not to minimise software count at all costs, it is to make every renewal defensible with current usage and named ownership so dormant capacity does not renew by default.
Related resources from NHI Mgmt Group
- How should security teams build an identity fabric to reduce SaaS identity sprawl?
- How should SaaS teams reduce friction on signup pages without weakening security?
- How should teams reduce the risk from overprivileged NHIs?
- How should teams reduce SaaS licence waste without breaking access for users who still need it?
