TL;DR: AI-assisted software creation is accelerating SaaS sprawl, shadow IT, duplicate contracts and unmanaged risk, according to Efecte, while Gartner cited in the source warns that organisations without central SaaS lifecycle management will be five times more likely to suffer cyber incidents or data loss by 2027. Visibility and lifecycle control, not innovation speed, now define the governance problem.
At a glance
What this is: This is a short analysis of how AI-assisted software creation is expanding SaaS sprawl and exposing a governance gap around visibility, ownership, and lifecycle control.
Why it matters: It matters because IAM, IGA, and procurement teams now need to govern who creates, uses, and retires software across business functions, not just approved enterprise tools.
By the numbers:
- Organisations that fail to centrally manage SaaS lifecycles will be five times more likely to suffer cyber incidents or data loss by 2027, according to Gartner research cited by Efecte.
- At least 25 percent of SaaS spend will be wasted on unused licenses and overlapping tools, according to Gartner research cited by Efecte.
Context
AI-assisted development is no longer confined to software teams. Employees across business functions can now create and deploy tools with consumer-grade AI, which increases the number of applications that enter the organisation outside traditional procurement and governance paths.
The governance gap is not the use of AI itself. It is the loss of visibility over application ownership, data location, licence duplication, and offboarding when software creation becomes distributed across the business.
For IAM and adjacent governance teams, the practical question is how to keep SaaS lifecycle management, access review, and accountability aligned when tools can appear faster than procurement and security can inventory them.
Key questions
Q: What breaks when AI-assisted SaaS creation happens outside governance?
A: The first thing that breaks is ownership. Once employees can stand up software without intake, no one can reliably answer who approved it, what data it touches, or who should retire it. That leads to duplicate tools, hidden access paths, and licence waste that traditional procurement and IAM reviews do not catch in time.
Q: Why does SaaS sprawl create security risk as well as cost pressure?
A: SaaS sprawl increases the number of accounts, roles, permissions, and integrations that must be governed. Each additional application adds another place where access review, approval, and offboarding can fail. The result is not just wasteful spend but a larger, harder-to-audit identity surface across business systems.
Q: How do organisations know if SaaS lifecycle automation is actually working?
A: Look for evidence that provisioning, approval, and revocation happen in the same workflow and that stale licenses disappear after role changes or departures. If users keep access after they no longer need it, automation is only partially implemented. Effective lifecycle automation shows up as faster offboarding, fewer abandoned licenses, and cleaner audit trails.
Q: What is the difference between SaaS access governance and SaaS inventory management?
A: SaaS inventory management answers what applications exist and who approved them. SaaS access governance answers who can use each app, what they can do inside it, and whether that access is still justified. Both are necessary. Inventory without governance leaves permissions unchecked, while governance without inventory misses shadow IT and hidden application risk.
Technical breakdown
How AI-assisted software creation accelerates SaaS sprawl
AI-assisted tools lower the effort needed to build internal applications, test ideas, and stand up workarounds. That sounds like innovation, but from an identity and governance standpoint it changes the rate at which software enters the estate. When non-technical staff can create useful tools without a formal intake path, the problem is not just more applications. It is more identities, more integrations, more data exposure paths, and more licences that sit outside normal lifecycle controls. The result is a shadow SaaS layer that grows faster than governance processes designed for centrally approved software.
Practical implication: treat AI-enabled app creation as a governance intake problem, not only an innovation issue.
Why SaaS lifecycle management becomes the control plane
SaaS lifecycle management is the discipline of knowing what exists, who owns it, who uses it, what data it touches, and when it should be renewed or retired. In a sprawl-heavy environment, that control plane becomes more important than the individual tool catalogue because it is the only layer that can reconcile contracts, usage, access, and business ownership. Without it, the organisation cannot reliably distinguish a sanctioned platform from a duplicate shadow service, nor can it prove that offboarding and licence recovery are happening consistently.
Practical implication: anchor governance to one lifecycle record that ties ownership, usage, access, and renewal together.
SaaS sprawl is also an identity governance problem
Every unmanaged application creates a new set of users, service accounts, token grants, and data permissions. That means SaaS sprawl is not purely a procurement or cost issue. It becomes an identity governance issue the moment access is created outside the core platform record and nobody can prove who approved it or who should remove it later. In NHI terms, the sprawl also multiplies machine-to-machine relationships that are rarely recertified with the same rigour as human access. Governance must therefore cover both human access and the non-human identities embedded in each app.
Practical implication: extend access reviews to the software layer and include service accounts, tokens, and app-to-app permissions.
Threat narrative
Attacker objective: The underlying risk is to gain ungoverned access to organisational data and software pathways through applications that security and IAM teams never formally approved.
- Entry begins when an employee uses an AI-assisted tool to create or adopt a SaaS application outside formal IT intake and approval.
- Privilege accumulates as the new application is connected to users, data, and integrations without central visibility or lifecycle tracking.
- Impact emerges through shadow IT, duplicated contracts, wasted licence spend, and a larger attack surface for cyber incidents or data loss.
Breaches seen in the wild
- Firebase misconfiguration exposure 2024: Missing Firebase security rules on 916 websites exposed 125 million user records and 19.87 million plaintext passwords; a quarter were fixed.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
SaaS sprawl is now an identity governance failure, not just a software inventory problem: AI-assisted creation multiplies the number of applications that can be brought into use without a formal intake path. Once that happens, the organisation loses reliable ownership, approval, and offboarding signals. The practitioner conclusion is that SaaS governance must be treated as a control surface in its own right.
Central SaaS lifecycle management is the decisive control plane for distributed software creation: When tools can be created by any employee, the enterprise needs one authoritative record for ownership, renewal, usage, and retirement. Without that record, procurement, security, and finance each see only part of the picture. The practitioner conclusion is that lifecycle management must become the system of record for software governance.
AI-driven software sprawl exposes a hidden non-human identity footprint: Each unmanaged SaaS application introduces tokens, service accounts, API grants, and delegated connections that rarely receive the same scrutiny as employee access. That creates an access estate that grows silently inside shadow applications. The practitioner conclusion is that identity governance must extend beyond users to the machine identities each app accumulates.
Visibility and accountability are the real resilience metrics in this category: The article correctly shifts the benchmark from speed to resilience, because speed without inventory creates blind spots faster than governance can close them. This is the governance gap that many midmarket organisations now face first. The practitioner conclusion is to measure whether every app has a named owner, a reviewed access model, and a retirement path.
Identity blast radius: The most useful concept here is the expanding footprint created when AI lowers the cost of building and adopting software. Every additional application multiplies the number of identities, contracts, and data routes that must be governed. The practitioner conclusion is that teams should judge SaaS sprawl by blast radius, not by app count alone.
From our research library:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
- Read next: AI Security Platform Buyer's Guide
What this signals
Identity blast radius: AI-assisted app creation expands the number of places where access, data, and ownership can drift away from governance. Teams should expect SaaS to behave less like a static portfolio and more like a constantly shifting identity surface that must be controlled at issuance and retirement.
SaaS governance programmes should now be measured against visibility rather than adoption speed. If an organisation cannot answer which business unit created an application, what data it touches, and whether any token or service account remains active after use, the control model is already behind.
Use the same discipline for SaaS sprawl that identity teams apply to privilege: define ownership early, track lifecycle state continuously, and treat unmanaged software as a risk-bearing identity boundary.
For practitioners
- Build a single SaaS inventory as the system of record Track every approved, pilot, and shadow application in one place with owner, business purpose, data classification, renewal date, and offboarding responsibility.
- Tie access reviews to application lifecycle events Trigger reviews when a SaaS app is first adopted, changed, renewed, or retired so that orphaned access and duplicate tools are surfaced early.
- Inventory non-human identities inside SaaS tools Record service accounts, API tokens, delegated credentials, and app-to-app connections for every SaaS platform so machine access is visible and reviewable.
- Reconcile contracts against actual usage Compare renewals and licence counts with real usage data to find dormant subscriptions, duplicate contracts, and shadow purchases before they become permanent cost.
- Create an intake path for AI-generated business apps Require business owners to register any AI-assisted application before it is connected to company data, workflows, or shared credentials.
Key takeaways
- AI-assisted software creation is expanding the SaaS estate faster than many governance processes can inventory it.
- The real control gap is visibility over ownership, usage, renewal, and retirement, not just the number of applications in the stack.
- Identity governance now has to include the non-human identities, tokens, and integrations that accumulate inside each SaaS tool.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CSA Cloud Controls Matrix, NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | SaaS sprawl introduces unmanaged users, tokens, and app-to-app access across cloud services. |
| Recommendation — Map SaaS ownership and access paths to IAM controls and enforce review of app-level entitlements. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centres on uncontrolled permissions and authorizations across SaaS applications. |
| Recommendation — Review SaaS entitlements continuously and remove access from shadow applications and unused tenants. | ||
| CIS Controls v8 | CIS-5 — Account Management | Unmanaged SaaS creation creates orphaned accounts, duplicate access and weak offboarding. |
| Recommendation — Centralise account lifecycle tracking for all SaaS applications and revoke dormant access quickly. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | AI-driven SaaS sprawl widens access beyond what least privilege can safely assume. |
| Recommendation — Limit SaaS access to the minimum necessary and recertify privileged entitlements after app adoption. | ||
| GDPR | Art.32 — Security of Processing | The article explicitly ties SaaS governance to GDPR and data protection obligations in Europe. |
| Recommendation — Assess SaaS lifecycle controls for their impact on personal data security and processing accountability. | ||
Key terms
- SaaS Lifecycle Automation: SaaS lifecycle automation is the use of workflows to manage application discovery, onboarding, offboarding, access changes, renewals, and license optimization. It helps IT and procurement teams reduce manual effort and improve control over the application estate. The focus is operational efficiency, not direct data loss prevention.
- Software Sprawl: Software sprawl is the accumulation of overlapping, redundant, or underused applications across an organisation. It becomes a governance problem when the volume of apps outpaces the ability to assign ownership, review access, and retire software cleanly.
- Shadow SaaS: Shadow SaaS is the set of unauthorised or unreviewed software-as-a-service tools used outside central security governance. These applications often bypass normal identity controls, making them difficult to inventory, monitor, and harden against credential-based abuse.
- Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 9, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org