CIO and CFO alignment depends on identity visibility and access control

At a glance

What this is: This is a Lumos blog post arguing that identity visibility, SaaS usage data and access governance help align CIO and CFO priorities by exposing shadow IT, unused licenses and the business value of access decisions.

Why it matters: It matters because IAM, IGA and SaaS governance teams increasingly need to prove that access control improves both security posture and budget discipline, not just compliance.

By the numbers:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.

Context

Identity visibility is the operational link between security governance and financial decision-making. In this article, Lumos frames the problem as one of knowing who can reach what, which apps are actually in use, and which access rights are no longer justified.

The underlying governance gap is that most organisations still manage SaaS usage, app access and spend in separate conversations. That separation leaves shadow IT, redundant licenses and unclear accountability to accumulate even when the tooling stack appears well governed.

Key questions

Q: How should security teams govern shadow IT in SaaS environments?

A: Security teams should govern shadow IT by treating it as unmanaged access, not just unsanctioned software. Start with continuous discovery, then map each app to owners, data types, delegated scopes, and revocation paths. The control goal is to reduce hidden access paths before they become business-critical dependencies.

Q: Why does access governance matter to finance as well as security?

A: Because access data shows not only who can reach applications, but also which tools are underused, duplicated or no longer creating value. When that evidence is shared with finance, it supports vendor rationalisation, tier changes and contract decisions without weakening control over the identity layer.

Q: What breaks when SaaS spend management is treated separately from identity governance?

A: The organisation can remove licences without removing accounts, or keep accounts active without any clear business need. That split leaves shadow access in place, weakens ownership, and produces a false sense of control because the finance view and the identity view never meet.

Q: How can organisations tell whether contextual access decisions are improving governance?

A: Look for fewer routine exceptions, faster certification cycles, clearer audit trails, and reduced reviewer fatigue. If context is useful, it should improve consistency without increasing false confidence. If approvals get faster but entitlement quality stays poor, the programme has accelerated administration rather than governance.

Technical breakdown

How app usage data becomes access governance

The mechanism here is continuous discovery across authentication and OAuth sources, then correlating that discovery with sanctioned application inventory and access rights. When IT can see which apps are being used, it can distinguish approved adoption from informal shadow IT and identify where access no longer matches business need. That same visibility also supports license rationalisation, because usage data shows which accounts are active, underutilised or dormant. The technical point is not mere reporting. It is correlation across identity, application and finance signals so that access becomes measurable instead of assumed.

Practical implication: build a joined inventory of authenticated app use, sanctioned apps and license assignments before attempting governance decisions.

Shadow IT discovery and SaaS spend control

Shadow IT is not just an application discovery problem. It is an access and procurement problem because unsanctioned apps often enter the environment through user authentication, not formal provisioning. Once that happens, SaaS spend and risk both grow outside standard approval paths. In this article’s model, visibility into login activity exposes those tools early enough to rationalise vendors, consolidate redundant subscriptions and challenge unnecessary tiers. The important technical shift is that discovery has to be identity-led, not finance-led or procurement-led, because the first signal of usage often appears in authentication logs rather than invoices.

Practical implication: use identity-connected discovery to catch unsanctioned SaaS use before it becomes embedded in spend and access baselines.

Why access governance now touches finance decisions

Access governance becomes financially relevant when the same control surface also reveals waste, duplication and business value. If teams can show which tools are actively used and which are sitting idle, they can justify tier changes, contract renegotiation and vendor reduction with evidence rather than intuition. That is why access visibility matters beyond classic IAM boundaries. It gives security and IT a common dataset that finance can trust, while still preserving governance over who reaches what. The article’s message is that governance data is most valuable when it can be operationalised across functions, not trapped in a compliance dashboard.

Practical implication: treat access analytics as an evidence source for vendor rationalisation, not only as an audit artefact.

NHI Mgmt Group analysis

Identity visibility has become a cross-functional control plane, not a reporting feature. Once app usage data is accurate enough to support budget decisions, it also becomes the authoritative source for governance conversations about access, risk and SaaS rationalisation. The practical consequence is that IAM, IGA and IT finance can no longer afford separate views of the same application estate. Teams should treat shared visibility as infrastructure for decision-making, not an afterthought.

Shadow IT is increasingly an identity problem before it is a procurement problem. Employees often reach tools through existing authentication paths long before those tools appear in a formal inventory. That means access telemetry is the earliest reliable signal of SaaS sprawl, and it is stronger than license reviews that rely on invoices alone. The implication is that governance must start from identity-connected discovery, because the usage pattern is already the risk pattern.

License optimisation and access governance are converging around the same evidence set. The article shows that underutilised subscriptions, redundant vendors and unnecessary access tiers are different expressions of the same operational issue: poor visibility into actual use. When the evidence set is shared, finance can act on cost while security can act on exposure without creating conflicting control stories. Practitioners should expect more budget decisions to depend on identity data, not just usage reports.

Coverage of SaaS access will increasingly be judged by whether it supports business accountability. The CIO-CFO relationship improves when access decisions can be tied to real usage, vendor value and risk exposure in the same conversation. That raises the bar for IAM programmes because they must prove more than entitlement control. They must also show that those controls produce measurable operating outcomes. Teams that cannot connect access to business value will struggle to influence spend decisions.

Identity visibility is now a shared language for security and finance governance. The article points to a named concept worth tracking: access visibility as an operating layer. That means the same telemetry can support governance, cost control and executive alignment if it is curated consistently. Practitioners should use that framing to design programmes that serve both control and commercial accountability.

From our research library:

• 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
• Read next: Top 10 NHI Issues

What this signals

Access visibility has become a governance prerequisite. When identity data is accurate enough to support SaaS spend decisions, it also gives security teams a cleaner basis for entitlement review and application rationalisation. The programme implication is straightforward: if access telemetry cannot support executive decisions, it is not mature enough to support governance either.

Shadow IT now surfaces first through authentication, not procurement. That means identity-led discovery should sit ahead of spreadsheet-based license audits if teams want to find unmanaged apps early. Practitioners should expect more of their SaaS governance work to start in access data rather than finance tooling.

For practitioners

• Build a single SaaS usage inventory Correlate Google OAuth, Okta and other authentication sources with sanctioned application records so that app usage, ownership and access rights are visible in one place.
• Use identity telemetry for shadow IT discovery Flag applications that appear in login data but not in procurement or approved software lists, then route them for review before they become normalised.
• Separate active from idle licenses Review usage patterns by account and application so underutilised subscriptions can be downgraded, reclaimed or consolidated with evidence.
• Tie access reports to budget decisions Present access trends, vendor overlap and usage evidence together so finance can evaluate spend reduction without losing governance context.

Key takeaways

• Identity visibility is doing more than supporting IAM operations. It is becoming a shared evidence layer for security, spend control and executive accountability.
• The article’s main risk signal is hidden SaaS usage and wasted licensing, which grow when app adoption is tracked outside identity telemetry.
• Teams should join access data to approved app inventories and procurement records so they can remove shadow IT, reclaim licenses and support finance decisions with the same dataset.

Key terms

• Identity Visibility: Identity visibility is the ability to see which identities exist, what they can access, and how those access paths relate across systems. In NHI programmes, it means correlating service accounts, tokens, certificates, and agents into one operational view so governance decisions are based on evidence, not assumptions.
• Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.
• SaaS Cost Optimisation: SaaS cost optimisation is the practice of reducing waste in software spending without removing tools that the business actually needs. It includes tracking usage, eliminating redundant applications, cancelling unused subscriptions, and negotiating renewals based on real demand. Effective optimisation depends on accurate inventory, ownership, and renewal visibility.
• Access Governance: Access governance is the policy and workflow layer that manages how access is requested, approved, certified, and revoked. In SaaS environments it helps standardise control across many applications, reducing inconsistency between teams. It is most effective when it covers both human accounts and non-human identities.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.