SaaS security demands proactive identity governance and visibility

At a glance

What this is: This is an analysis of why SaaS security fails when access, data, and governance are treated as vendor responsibilities instead of continuously managed identity controls.

Why it matters: It matters because IAM, IGA, and NHI teams increasingly have to govern SaaS as a distributed identity surface with third-party access, orphaned subscriptions, and weak visibility.

By the numbers:

• 71% of businesses had orphaned SaaS subscriptions, according to Zluri's cited Ping Identity study.

Context

SaaS security is fundamentally an identity governance problem because access, sharing, and third-party connections now sit across business applications rather than inside a single owned perimeter. When teams assume the vendor will absorb most of the security burden, they lose visibility into who can reach data, how access changes, and which subscriptions should still exist.

Zluri argues that the risk is not SaaS itself but the mismatch between modern application sprawl and reactive security habits. The article frames orphaned subscriptions, weak SLAs, and limited transparency as symptoms of a governance model that does not keep pace with how software is actually consumed.

The operational question is whether the organisation can continuously monitor, review, and revoke access across the SaaS stack. Without that discipline, identity and data controls fragment across tools, business units, and external providers, which is typical of fast-growing SaaS estates.

Key questions

Q: How should teams govern SaaS security when the vendor manages the application stack?

A: Treat SaaS as a governed identity surface rather than a fully outsourced control environment. The organisation still owns access approvals, entitlement reviews, offboarding, third-party oversight, and data visibility. If those controls stop at the perimeter or directory, SaaS sprawl will outpace governance and leave stale access behind.

Q: What breaks when SaaS subscriptions are left orphaned?

A: Orphaned subscriptions create access that no one can confidently explain, review, or retire. That leads to hidden data exposure, audit gaps, and persistent entitlement drift. The problem is usually not one account, but the absence of lifecycle linkage between business ownership, identity records, and application access.

Q: How should security teams spot suspicious third-party access in SaaS environments?

A: Watch for new OAuth grants, unexpected scope expansion, token creation, and bursts of enumeration across connected applications. Those signals often appear before visible data theft. Teams should correlate identity logs, SaaS admin events, and connected-app activity so a vendor-side compromise does not look like normal user behaviour.

Q: Why do organisations need continuous visibility across SaaS applications?

A: Because SaaS risk is distributed across subscriptions, identities, integrations, and data-sharing paths. Continuous visibility is what lets teams detect stale access, policy drift, and hidden third-party exposure before they become audit findings or data incidents. Without it, governance becomes reactive and incomplete.

Technical breakdown

Why SaaS security becomes an identity governance problem

SaaS moves critical access decisions into externally managed applications, but the organisation still owns who can use them, what data they can reach, and when access should end. In practice, that means identity governance, not infrastructure hardening, becomes the control plane. The article highlights user roles, access transparency, third-party delivery, and compliance as the main pressure points. In a SaaS estate, the security boundary is defined less by servers and more by entitlements, sharing links, federated access, and application-level permissions.

Practical implication: Treat SaaS applications as governed identity surfaces and map them into your access review and offboarding processes.

Orphaned SaaS subscriptions and the visibility gap

An orphaned SaaS subscription exists when an account, licence, or application instance remains active without a valid business owner or user need. That is more than wasteful spending. It creates unmanaged access paths, unclear accountability, and review fatigue because teams cannot distinguish live business use from stale entitlement drift. The article’s cited 71% orphaned-subscription figure shows how common this problem is when provisioning and offboarding are not tightly linked to governance workflows.

Practical implication: Inventory SaaS subscriptions continuously and tie each one to an owner, purpose, and removal trigger.

Third-party access and weak SLA transparency

SaaS security often depends on external suppliers, adjacent integrators, and delegated support arrangements that sit outside direct operational control. If the organisation cannot see what security protocols exist, how policy updates are handled, or who else can access the environment, it cannot confidently assess exposure. This is where assurance drift appears: the contract suggests one control posture, but the lived access model is broader and less observable. That gap is especially relevant when multiple vendors participate in delivery or support.

Practical implication: Review SaaS supplier access, update, and recovery terms as governance controls, not just legal language.

Threat narrative

Attacker objective: The objective is to reach business data and application access through unmanaged SaaS entitlements that the organisation no longer actively governs.

1. Entry occurs through broad SaaS adoption, where applications are added faster than ownership, access review, and offboarding controls can keep up.
2. Credential or access abuse then appears through orphaned subscriptions, weak passwords, sharing, or third-party pathways that remain active after the original need has passed.
3. Impact follows as data access, privacy, compliance, and governance drift spread across the SaaS estate, making containment and accountability harder to reconstruct.

Breaches seen in the wild

• SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

SaaS security is an identity governance problem before it is an application security problem. The article shows that the real failure mode is not the software model itself but the absence of continuous control over entitlements, ownership, and third-party access. Once SaaS becomes the operating layer for core business functions, identity governance has to extend into every app instance, not sit outside it. Practitioners should treat SaaS as a governed access surface, not a vendor-managed exception.

Orphaned subscriptions are a lifecycle failure, not just a licensing issue. Stale SaaS accounts persist because joiner, mover, and leaver processes often stop at the directory while the application layer keeps its own state. That creates hidden access, unclear accountability, and a false sense of coverage in recertification. The governance lesson is that lifecycle management must follow the subscription itself, not merely the user record.

Federated access opacity: SaaS environments frequently hide how much trust is being extended to external services, support paths, and delegated administrators. The article makes clear that when teams cannot see update cadence, security assumptions, or extra-party involvement, they cannot reliably govern risk. That is a visibility gap with operational consequences, not a minor documentation issue. Practitioners need to recognise that trust without observability quickly becomes unmanaged exposure.

Proactive SaaS oversight is now part of the identity security baseline. The article’s core message is that reactive security cannot keep pace with low-code sprawl, vendor dependencies, and distributed data use. This reinforces a broader market shift toward continuous entitlement control, application visibility, and cross-application governance. Teams that still separate SaaS oversight from identity operations will keep discovering problems after access has already become business-critical.

From our research library:

• 1 in 3 organisations encountered suspicious AI agent activity in 2025, and 99.4% experienced a SaaS or AI ecosystem incident.
• Read next: Identity Security Programme Guide

What this signals

Federated access opacity: SaaS risk is often created by what teams cannot see, not only by what they can configure. Visibility into subscriptions, external access, and entitlement ownership is now a baseline governance requirement for any identity programme that includes business applications.

As SaaS estates expand, IAM and IGA teams need a control model that links provisioning, review, and revocation to the application layer. Otherwise, the directory may look clean while the real access surface keeps growing in the background.

For practitioners

• Map every SaaS application to an accountable owner Maintain a live inventory that ties each SaaS app to a business owner, security owner, and removal trigger so orphaned subscriptions can be retired quickly.
• Build SaaS access into joiner-mover-leaver workflows Extend onboarding, role change, and offboarding processes into the application layer so access changes are not left behind in dormant subscriptions.
• Review third-party access paths and service delivery roles Document which vendors, partners, and support teams can touch SaaS data, then verify those paths are still justified and approved.
• Standardise recurring SaaS access reviews Use periodic entitlement reviews to confirm that application access, sharing rights, and admin roles still match current business need.
• Measure SaaS visibility across the application stack Track whether security teams can see active subscriptions, privileged access, and data-sharing routes across the full SaaS estate.

Key takeaways

• SaaS security fails when organisations let application ownership and access governance drift apart from identity operations.
• The article points to orphaned subscriptions, weak transparency, and third-party access as the main control gaps, with 71% of businesses cited as having orphaned SaaS subscriptions.
• Continuous visibility and lifecycle-linked access reviews are the practical controls that keep SaaS from becoming an unmanaged identity surface.

Key terms

• Orphaned SaaS Subscription: A SaaS subscription that remains active even though the business need, owner, or user relationship has ended. These subscriptions keep licences, access paths, and sometimes data exposure alive, creating unnecessary security and compliance risk because nobody is actively accountable for them.
• SaaS Lifecycle Governance: SaaS lifecycle governance is the set of controls that manage applications from onboarding through access assignment, renewal, and decommissioning. It matters because the security value of SaaS management depends on whether the organisation can prove ownership, revoke access, and retire unused tools on demand.
• Third-Party Access: Third-party access is access granted to vendors, contractors, or support partners who are not direct employees of the organisation. It is higher risk than internal access because accountability, device assurance, and access duration are harder to control, so it usually requires tighter time limits and stronger auditability.
• Access Visibility: Access visibility is the ability to see, in one place, which identities can reach which data, applications, and services. For IAM and data security teams, it is the difference between reviewing isolated permissions and understanding real blast radius across environments.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.