IT asset visibility gaps are still driving SaaS risk

At a glance

What this is: This is a Zluri analysis of four IT asset management problems, with incomplete SaaS visibility presented as the root issue behind sprawl, risk, and inefficient renewals.

Why it matters: It matters because IAM, IGA, and SaaS governance teams need discovery, access control, and lifecycle discipline to keep unmanaged apps from becoming security and compliance debt.

By the numbers:

• Zluri says it directly integrates with 300+ apps.
• Zluri says contract alerts can arrive 30 days, 15 days, 7 days, and 1 day before renewal.

Context

SaaS visibility is an identity and governance problem before it is a tooling problem. When organisations cannot see which apps exist, who approved them, or whether they are still in use, access oversight and lifecycle control both degrade.

This article treats IT asset management as the control plane for SaaS risk. The governance gap is not only unmanaged software, but unmanaged relationships between apps, users, renewals, and offboarding decisions.

For IAM and IGA teams, that makes SaaS inventory quality a prerequisite for trustworthy access decisions. If discovery is incomplete, certification, revocation, and renewal processes are all operating on partial data.

Key questions

Q: What breaks when SaaS discovery is incomplete?

A: Incomplete discovery leaves shadow apps, duplicate subscriptions, and employee-purchased tools outside the control model. That means invoices cannot be matched cleanly, renewal decisions are based on partial data, and ownership remains ambiguous. In practice, the organisation pays for services it cannot reliably govern or retire.

Q: Why does fragmented SaaS management create security and operational risk for growing organisations?

A: Fragmented SaaS management creates risk because usage, licenses, and permissions become scattered across tools and teams. Without a single source of truth, IT struggles to see who has access, which apps are unused, and where manual errors are introduced. That weakens governance, increases waste, and makes it harder to keep access aligned with job responsibilities.

Q: How can teams tell whether SaaS governance is actually working?

A: Look for evidence that discovered applications can be assigned an owner, tied to an access policy, and removed through an enforced workflow. If the platform can only report on SaaS usage but cannot drive deprovisioning or entitlement review, governance is still fragmented.

Q: Why do SaaS renewals matter to IAM and access governance?

A: SaaS renewals matter because subscription continuation often keeps access alive even when business need has ended. If renewal, ownership, and offboarding are separate processes, organisations end up paying for software that still has active access paths attached. IAM teams should treat renewal timing as part of entitlement governance, not just procurement administration.

Technical breakdown

Why SaaS discovery is the first control boundary

SaaS discovery is the process of identifying applications purchased, connected, or used across the organisation. In distributed environments, apps enter through procurement, employee choice, expense systems, identity providers, and direct integrations, so no single source of truth is enough. The technical problem is not merely inventory, but correlation across data sources that were never designed to describe one another. Without that correlation, shadow apps and duplicate apps remain invisible until they become access, compliance, or cost problems.

Practical implication: build a discovery layer that reconciles identity, finance, and endpoint signals before you trust any SaaS inventory.

How access oversight fails when SaaS ownership is fragmented

Access oversight breaks when app ownership is spread across business units and no one maintains a complete view of who can use what. In that model, unused apps linger, ex-employees retain access, and unauthorized users can remain attached to systems long after the original business need has disappeared. The security failure is not just overprovisioning. It is the absence of a controlled lifecycle from assignment to revocation, which makes access review and offboarding less reliable.

Practical implication: tie app ownership and access revocation to lifecycle events so stale SaaS access cannot persist unnoticed.

Why renewal metrics change SaaS governance decisions

Usage metrics turn SaaS from a static catalogue into an operational signal. When teams can see usage patterns, renewal dates, and app-level risk, they can distinguish business-critical software from abandoned or duplicated tools. That matters because renewal decisions affect both financial exposure and security exposure. If a rarely used application still carries access rights and data-sharing permissions, renewing it without review extends governance debt rather than reducing it.

Practical implication: require usage evidence and renewal visibility before approving contract extensions or auto-renewals.

Threat narrative

Attacker objective: The objective is not one single breach event but an expanded, poorly governed SaaS estate that is easier to misuse, harder to audit, and more expensive to control.

1. Entry occurs when SaaS applications are acquired outside central visibility, such as through decentralized purchasing or employee-led adoption.
2. Privilege accumulation follows when unused apps, duplicate apps, or ex-employee access remain active because no one has a complete lifecycle view.
3. Impact appears as shadow IT, avoidable SaaS spend, audit exposure, and a larger attack surface for unauthorized access or data sharing.

NHI Mgmt Group analysis

Incomplete SaaS visibility is a governance failure, not an inventory inconvenience. If the organisation cannot see which applications exist, every downstream control becomes probabilistic. Discovery, ownership, access review, and renewal all depend on the same incomplete picture, so the programme is already operating with blind spots. The practitioner conclusion is that SaaS visibility must be treated as a control dependency, not a reporting nicety.

SaaS sprawl is what happens when access and lifecycle decisions are separated. Apps are approved, used, abandoned, and renewed through different processes, often by different teams. That fragmentation creates the conditions for stale access, duplicate tools, and unmanaged subscriptions. The implication for IAM and IGA teams is to align procurement, provisioning, and offboarding around a shared lifecycle view.

Renewal governance is part of identity governance once apps carry access and data rights. A renewal decision is not just a finance event. It is an access decision, because renewing an app preserves the accounts, permissions, and data flows attached to it. The practitioner conclusion is that contract review and access review should not live in separate silos.

SaaS lifecycle drift is the named failure mode here. Apps enter the estate faster than teams can reconcile ownership, usage, and entitlement state, so the organisation ends up governing yesterday's reality. That drift is especially visible in decentralised buying models where business teams procure first and ask questions later. The conclusion is that lifecycle governance has to start at acquisition and continue through offboarding and renewal.

Access review cannot compensate for missing discovery. Certification only works when the app catalogue is accurate and current. If shadow SaaS and duplicate apps are already outside the record, reviewers are certifying an incomplete estate. The practitioner conclusion is that recertification quality depends on discovery quality.

From our research library:

• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
• Read next: IGA Buyer's Guide

What this signals

SaaS lifecycle drift: organisations lose control when discovery, access, and renewal are managed as separate processes rather than one governance chain. Once that split exists, abandoned apps and stale permissions persist longer than the business need that created them.

Completeness of the app inventory is the practical threshold that determines whether recertification and offboarding are reliable or merely administrative. When app visibility is partial, the control surface is partial too, and the programme will miss the very assets it claims to govern.

For practitioners

• Tighten SaaS discovery inputs Reconcile identity provider data, finance records, direct integrations, and endpoint signals into one owned inventory so shadow apps do not evade review.
• Link app ownership to lifecycle events Assign clear business and IT ownership for each application, then trigger review and revocation actions when users change role or leave.
• Separate renewal approval from auto-renewal Require documented usage evidence and security review before extending contracts, especially for applications with low activity or duplicate function.
• Review SaaS access before offboarding closes Make SaaS entitlement checks part of leaver processing so dormant app access is removed before the account lifecycle is complete.
• Track app duplication as a governance metric Measure duplicate and abandoned applications alongside spend and usage so rationalisation decisions can be made with defensible evidence.

Key takeaways

• Incomplete SaaS visibility turns ITAM into a governance problem because security, compliance, and spend controls all depend on the same inventory.
• The article's most important warning is that unmanaged apps and stale access emerge together when discovery and lifecycle ownership are fragmented.
• The practical fix is to connect discovery, ownership, access review, and renewal so SaaS governance can operate on a complete estate.

Key terms

• SaaS Sprawl: SaaS sprawl is the uncontrolled spread of software-as-a-service applications across teams and business units. It creates fragmented ownership, duplicated functionality, and weak visibility into who can access what. For IAM and NHI teams, the main risk is not only cost but persistent entitlements that outlive business need.
• It Asset Management: IT asset management is the discipline of tracking technology assets across their useful life so they can be procured, deployed, maintained, renewed, and retired with accountability. In security programmes, it becomes valuable when lifecycle records are tied to ownership, entitlement, and revocation decisions.
• Access Recertification: Access recertification is the periodic review of user or account permissions to confirm that access is still justified. It is useful, but it is not enough on its own because it reacts after entitlements already exist, which is why lifecycle governance must reduce the volume of exceptions before review time.
• Renewal Governance: Renewal governance is the control process that decides whether a subscription should continue, be reduced, or be removed. It connects ownership, usage, contract terms, and budget approval so recurring spend is not allowed to renew automatically without a fresh business justification.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.