Josys recognition in Gartner’s SaaS management quadrant

At a glance

What this is: This is a Josys press release about Gartner’s 2025 SaaS Management Platforms quadrant, highlighting the governance pressure created by SaaS sprawl, generative AI usage, and the need for centralized application control.

Why it matters: It matters because IAM and IGA teams have to govern SaaS access, lifecycle, and entitlement drift across rapidly expanding app estates, not just track licenses or inventory.

By the numbers:

• Gartner predicts that through 2028, over 70% of organisations will centralize SaaS application management using a SaaS management platform, an increase from less than 30% in 2025.
• Josys maintained an overall 4.6/5 rating with 78 Reviews on Gartner Peer Insights for SaaS Management Platforms as of 30 August 2025.

Context

SaaS management is becoming an identity governance problem, not just an inventory problem. When application count, generative AI usage, and contract sprawl rise together, IT loses the ability to see who has access, which apps are active, and which entitlements should still exist.

Josys cites Gartner’s view that SaaS management platforms are meant to address overspend, elevated risk, lack of visibility, and contract sprawl. That framing matters because the control gap is broader than licence optimisation: it reaches app access review, onboarding and offboarding, and entitlement drift across the SaaS estate.

Key questions

Q: Why do SaaS management gaps often turn into access governance problems?

A: Because the same blind spots that hide rogue apps also hide who can use them. If an application enters the environment outside approved discovery paths, the organisation may never review the accounts, tokens, or delegated access that come with it. That turns an inventory gap into a lifecycle and entitlement gap.

Q: Why does SaaS sprawl increase non-human identity risk?

A: SaaS sprawl increases NHI risk because every new integration can create tokens, service accounts, OAuth grants, and delegated permissions that persist outside normal review cycles. Those identities often have more reach than human users and fewer lifecycle checks. The result is wider attack surface and harder-to-audit access paths.

Q: What do security teams get wrong about SaaS spend visibility?

A: They often mistake visibility for control. Spend data can help find waste, but it does not prove access is appropriate or current. A team can reduce license cost and still leave orphaned accounts, unused privileged roles, or stale service access in place.

Q: What should teams do when third-party SaaS access outlives the business need?

A: They should revoke the connection, reassign ownership, and require a fresh approval path before the integration is restored. Third-party SaaS access should be treated as governed access, not permanent convenience. If the business relationship changes, the access relationship must change with it.

Technical breakdown

Why SaaS sprawl breaks identity governance

SaaS sprawl creates too many independent control points for manual governance to keep pace. Each application may have its own provisioning flow, admin model, OAuth connection, and licence record, which makes it easy for access to outlive business need. In practice, the problem is not simply discovery, but control consistency across a fragmented application estate. When generative AI tools are added to the mix, the number of shadow integrations and informal app decisions rises further. That pushes IAM and IGA from periodic review toward continuous visibility and lifecycle control.

Practical implication: map every SaaS application to an owner, access path, and offboarding trigger before treating the estate as governable.

How SaaS management platforms change control points

A SaaS management platform concentrates visibility, utilisation data, and lifecycle actions into a single operating layer. That does not replace IAM or IGA, but it does change where governance decisions happen. Instead of reviewing apps one by one after the fact, IT can compare actual usage, entitlement status, and provisioning state against policy in one place. For practitioners, the architectural shift is important: the control objective moves from isolated administration to coordinated access and app lifecycle management across the full portfolio.

Practical implication: align SaaS management workflows with joiner-mover-leaver processes, recertification, and entitlement cleanup.

What visibility means when entitlements drift

Visibility only matters if it reveals actionably stale access. Licence usage alone does not show whether a dormant account still has privilege, whether a connected app can still reach business data, or whether a departed employee’s access was ever removed from the SaaS stack. That is why SaaS governance sits close to identity lifecycle management. The useful signal is not just how many apps exist, but whether access, ownership, and authorisation states can be reconciled quickly enough to prevent drift from becoming accepted normality.

Practical implication: treat dormant licences, orphaned admins, and stale OAuth grants as identity findings, not procurement noise.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

SaaS management is now an identity control plane problem. The article reflects a broader shift in which app sprawl is no longer just a procurement or operations headache. Once SaaS estates become dense enough, governance must cover who can access what, whether that access still matches role and business need, and how quickly stale permissions are removed. Practitioners should stop treating SaaS management as a separate tooling conversation and start treating it as part of identity control design.

Visibility without lifecycle enforcement is incomplete governance. Seeing apps and licences is useful, but it does not by itself reduce risk if access can persist after the business need disappears. That distinction matters for IGA teams, because app inventory, ownership mapping, and access review only become meaningful when they connect to revocation and reassignment. Practitioners should look for where visibility stops and where control actually begins.

Contract sprawl and entitlement sprawl are the same governance problem at different layers. The article links overspend and risk, which is the right connection for practitioners. Unused licences, redundant applications, and stale access all signal weak lifecycle discipline. The practical conclusion is that SaaS rationalisation, access governance, and offboarding need to be run as one programme rather than three disconnected efforts.

Third-party SaaS exposure is a NHI governance issue, not just a vendor risk issue. Josys’s discussion of SaaS centralisation aligns with the wider reality that external applications often carry machine-level access, delegated permissions, and persistent integrations. The governance question is whether those third-party connections are inventoried, owned, and revoked when no longer needed. Practitioners should treat SaaS app governance as part of NHI lifecycle and third-party access control.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.
• Read next: SaaS-to-SaaS and OAuth App Governance Guide

What this signals

SaaS governance now needs an ownership layer, not just an inventory layer. When app sprawl grows, the real question becomes who can approve access, remove it, and attest that the decision still matches business need. Without that ownership layer, lifecycle management becomes a reporting exercise instead of a control system.

Third-party app connections are part of the identity perimeter. Once OAuth grants, API keys, and SaaS-to-SaaS links become common, governance has to treat them as access paths with lifecycle obligations. The practical implication is that app governance, offboarding, and third-party access reviews need to be run together, not as separate workstreams.

For practitioners

• Define a SaaS ownership model Assign each application a business owner, technical owner, and offboarding trigger so access decisions are accountable end to end.
• Reconcile access against actual usage Compare live entitlements, licence utilisation, and admin rights on a regular cadence to expose dormant access and redundant app spend.
• Tie SaaS review to JML workflows Update joiner-mover-leaver processes so SaaS accounts, connected apps, and delegated access are removed or re-assigned when roles change.
• Track third-party integrations as governed access Inventory OAuth grants, API keys, and app-to-app connections alongside user access so external reach is subject to review and revocation.

Key takeaways

• SaaS management is drifting into the identity governance domain because app sprawl and delegated access now drive access risk as much as licence cost.
• The article’s cited Gartner data points to centralization as the dominant operating model, which makes ownership, lifecycle, and entitlement cleanup more important than simple discovery.
• Practitioners should connect SaaS visibility to joiner-mover-leaver processes and third-party access controls, or sprawl will keep outpacing governance.

Key terms

• SaaS Management Platform: A SaaS management platform is a visibility and optimisation layer for cloud software use. It helps teams discover applications, track utilisation, and understand spend patterns, but it does not by itself enforce access policy, revoke permissions, or manage identity lifecycle state.
• Entitlement Drift: Entitlement drift is the slow accumulation of permissions that no longer match the original purpose, role, or workload. In cloud-native and NHI-heavy environments, it usually happens because access changes faster than review cycles, leaving organizations with more privilege than they intended.
• Third-Party SaaS Risk: Third-party SaaS risk is the exposure created when an external software service connects to an organisation’s users, data, or systems. It includes vendor posture, but also the way the application is actually used, authenticated, and controlled inside the enterprise. Effective management requires visibility into both sides.
• Runtime Enforcement: Runtime enforcement is the practice of blocking malicious behaviour while software is running, rather than only detecting it after the fact. It monitors process activity, network actions, and privilege changes so a live attack can be interrupted at the point of execution.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.