TL;DR: Demand for SaaS and AI governance across the workforce is rising as embedded AI, integrations, and non-human identities create a governance gap that traditional controls do not inventory well, according to Nudge Security. Nudge Security raised $22.5 million in Series A funding led by Cerberus Ventures while reporting 3x ARR growth for two consecutive years and nearly 200 customers.
At a glance
What this is: This is a funding announcement framed around the growing need to govern workforce SaaS and AI use, with the key finding that embedded AI, integrations, and non-human identities are expanding the governance gap.
Why it matters: It matters because IAM, IGA, and security teams now have to govern a broader, more dynamic application and identity surface that includes AI-enabled apps, integrations, and machine access paths.
Context
Workforce SaaS and AI governance is the problem space here. The challenge is not just finding apps, but understanding who and what is connecting them, what data they can reach, and whether those connections are still justified as tools, users, and workflows change.
The article describes a market signal rather than a product tutorial: security teams are dealing with hundreds of AI-enabled applications, complex integration chains, and non-human identities that traditional discovery and access controls do not inventory well. That is a governance problem for IAM, IGA, and SaaS security programmes, not just a tooling issue.
Key questions
Q: Where does workforce SaaS governance fail when embedded AI and integrations multiply?
A: It fails when governance is limited to approved app lists and named users. Once AI features, integrations, and delegated identities are distributed across many tools, the real control surface shifts to data flow, machine access, and offboarding discipline. Teams need continuous inventory and review across all three, not isolated point checks.
Q: Why do non-human identities create extra risk in SaaS environments?
A: Non-human identities often carry durable access, broad permissions, and weaker behavioural oversight than human users. In SaaS, that makes service accounts, API keys, and integration tokens attractive targets because attackers can abuse them without obvious login anomalies. The risk grows when these identities are poorly inventoried or rarely reviewed.
Q: What are the signs that SaaS governance is lagging AI adoption?
A: Common signs include surprise AI-enabled apps, unexplained integrations, inconsistent ownership of app-to-app connections, and access reviews that cover people but not delegated identities. If security teams cannot explain which machine credentials connect which systems, the governance model is already behind actual usage.
Q: How should teams respond when SaaS tools accumulate hidden machine access?
A: They should treat hidden machine access as an identity lifecycle issue and remove stale delegated privileges as part of offboarding and recertification. That includes revoking obsolete tokens, documenting owners for each integration, and bringing app connections into the same governance cadence used for human access.
Technical breakdown
Why SaaS and AI governance now extends beyond app inventory
SaaS governance used to centre on discovering applications and reviewing user access. That model is no longer sufficient when embedded AI, integrations, browser-side automation, and machine identities can all create access paths into the same data and workflows. The practical shift is from knowing which apps exist to understanding how each app exchanges identity, data, and authority with the rest of the environment. When AI capabilities are embedded inside ordinary business applications, the control boundary becomes the interaction layer, not the application name alone.
Practical implication: inventory applications, integrations, and identity links together instead of treating app discovery as a standalone exercise.
What non-human identities change in workforce SaaS governance
Non-human identities in SaaS environments include tokens, service accounts, OAuth grants, API keys, and automation identities that allow apps and agents to act without a human present. These identities often outlive the human workflow that created them, which creates standing access, hidden privilege, and weak ownership. In a workforce SaaS model, the risk is not only external compromise but also accumulated trust across app-to-app connections that nobody revalidates. That is why access review processes built for named users miss a major part of the real exposure surface.
Practical implication: bring machine and delegated identities into the same governance path as employee access reviews.
Why AI governance and SaaS security are converging
The article reflects a broader convergence: AI use is no longer isolated in specialist tools, because many SaaS products now embed AI features, agents, and connectors. That means governance has to cover both the AI function and the SaaS control plane it sits inside. Security teams need to think in terms of data flow, delegated authority, and third-party risk across the full ecosystem. Once AI can act through integrations, the question changes from whether an app has AI to whether that AI can operate with enough reach to affect data, identity, and policy boundaries.
Practical implication: assess embedded AI features as part of SaaS risk reviews, not as a separate innovation track.
Threat narrative
Attacker objective: The objective is to reach sensitive data and business workflows through trusted SaaS connections that were never fully governed as identity assets.
- Entry occurs through ordinary workforce adoption of SaaS apps, embedded AI features, and connected services that are not consistently inventoried or reviewed.
- Credentialed access expands through OAuth tokens, API keys, integrations, and other non-human identities that persist beyond the original business need.
- Escalation happens when those connections accumulate across the SaaS ecosystem, creating broader access paths than any single user or team intended.
- Impact follows as sensitive data, governance decisions, and third-party exposure become harder to control, especially when offboarding and review processes do not cover machine access.
Breaches seen in the wild
- SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Workforce SaaS governance is becoming an identity problem, not just an application problem. The article reflects a market in which discovery, access review, and offboarding must now account for apps, integrations, and delegated machine access together. That is a structural change in governance scope, and it pushes IAM and SaaS teams to treat connected services as first-class identity objects.
Embedded AI collapses the old boundary between application security and access governance. When AI features sit inside everyday business apps, the governance question is no longer whether a tool is approved, but whether its delegated authority is visible and controllable. That means security programmes have to review the reach of the embedded function, not just the parent application.
Non-human identity sprawl is the named concept this funding round points to. Machine credentials, tokens, and integrations are now part of normal workforce productivity, which means they can quietly accumulate outside standard employee lifecycle controls. The practitioner implication is clear: governance models that only certify human access are already incomplete.
Automated discovery is now a baseline expectation for SaaS and AI governance. The funding story reinforces that organisations need continuous visibility into tools, identities, and integrations as they appear and change. Static questionnaires and annual reviews cannot keep up with the speed of workforce software adoption, so governance has to move closer to runtime reality.
Identity governance for SaaS now depends on third-party trust management. The article’s emphasis on supply chain risk, integrations, and AI-enabled apps shows that access control is no longer bounded by the organisation’s own accounts. Practitioner teams have to evaluate external connections as part of the same risk picture as user provisioning and application approval.
From our research library:
- 1 in 3 organisations encountered suspicious AI agent activity in 2025, and 99.4% experienced a SaaS or AI ecosystem incident.
What this signals
Workforce SaaS governance is moving toward continuous identity control. Teams can no longer rely on annual access reviews when application change, AI adoption, and integration sprawl happen continuously. The governance model has to move closer to runtime so that machine access is visible when it is created, used, and retired.
Delegated access is becoming part of the enterprise identity perimeter. SaaS approvals that ignore integrations and service credentials leave a blind spot that extends well beyond the human user base. Security and IAM teams should expect this perimeter to be managed as a living set of identities, not a static catalogue of apps.
For practitioners
- Inventory apps, integrations, and delegated identities together Build a single view of SaaS applications, embedded AI features, OAuth grants, API keys, and automation accounts so that ownership and scope can be reviewed in one place.
- Extend access reviews beyond named users Include service accounts, tokens, and app-to-app connections in recertification so machine access is reviewed on the same cycle as employee access.
- Add lifecycle offboarding for SaaS connections Revoke integrations, machine credentials, and stale delegated access when users leave teams, apps change owners, or tools are retired.
- Evaluate embedded AI during vendor risk review Treat AI features inside SaaS products as part of the application’s access and data exposure profile, not as a separate product category.
Key takeaways
- Workforce SaaS governance now has to cover human users, embedded AI, and non-human identities in one control model.
- The article signals that discovery alone is not enough, because integrations and delegated access can create hidden privilege across the SaaS stack.
- Practitioners should extend lifecycle governance, recertification, and offboarding to the machine connections that sit behind everyday SaaS use.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 — Vulnerable Third-Party NHI | The article centres on connected SaaS tools and delegated identities that extend trust beyond owned systems. |
| NHI-05 — Overprivileged NHI | It highlights delegated access and integration sprawl that can exceed intended scope. | |
| NHI-10 — Human Use of NHI | Workforce-driven tool adoption creates non-human access behind everyday human activity. | |
| Recommendation — Inventory and review third-party SaaS identities before they become unmanaged access paths. Reduce delegated permissions that allow SaaS integrations to exceed their intended scope. Map human-initiated SaaS use to the machine identities it creates or reuses. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article concerns lifecycle control over tokens, API keys, and delegated authenticators. |
| Recommendation — Apply authenticator management to rotate and revoke SaaS credentials when their purpose changes. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The core issue is controlling entitlements across users, apps, and machine access. |
| Recommendation — Govern entitlements across SaaS users, integrations, and machine identities as one access set. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The threat pattern involves trusted credentials and connected services being used to move through SaaS environments. |
| Recommendation — Map risky SaaS connections to credential access and lateral movement paths in detection logic. | ||
Key terms
- Workforce Edge: The workforce edge is the point where people make day-to-day technology choices across approved and unapproved SaaS and AI tools. It matters because identity risk often appears there first, when access, sharing, and integration decisions happen outside the central control plane.
- Runtime AI Governance: Runtime AI governance is control applied while the interaction is happening, rather than before deployment or after an incident. It combines discovery, policy enforcement, output inspection, and audit logging so that AI use can be managed in live enterprise conditions.
- Delegated Identity: Delegated identity is when one actor acts on behalf of another with explicit permission and bounded authority. In AI-assisted commerce, it requires clear consent, limited scope, and traceable records so the retailer can distinguish authorised delegation from unauthorised automation.
- SaaS Supply Chain Security: SaaS supply chain security is the practice of governing the trusted connections between cloud applications. It focuses on OAuth tokens, API integrations, third-party apps, and service accounts that can move data without changing code. The main concern is delegated access that outlives the original approval.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 20, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org