TL;DR: SaaS spend management becomes an identity governance problem when duplicate apps, unrevoked subscriptions, and unmanaged renewals let access and spending drift outside IT control, according to Zluri. The operational issue is not just cost control, but whether organisations can actually see, right-size, and retire application access before waste becomes risk.
At a glance
What this is: This is a SaaS spend management analysis showing that overspending is driven by app duplication, unused subscriptions, unrevoked licenses, and unmanaged renewals.
Why it matters: It matters because SaaS buying has become a shadow identity and lifecycle problem, so IAM and IGA teams need visibility into who can access what before cost waste becomes access sprawl.
By the numbers:
- The global SaaS spend management market size was valued at US$ 611 million in 2022 and is projected to reach US$ 2456.8 million by 2029.
- SaaS occupies nearly 6-10% of the budget for 31% of IT decision-makers.
Context
SaaS spend management is the discipline of seeing which cloud applications are in use, who bought them, who uses them, and which subscriptions should be renewed or retired. In this article, Zluri argues that the financial problem is inseparable from identity governance because app sprawl, duplicate purchasing, and forgotten renewals all reflect weak visibility over access and ownership.
The governance gap appears when business teams can acquire tools without a central approval path and when IT cannot reliably reconcile licenses, usage, and ownership. That makes SaaS spend a practical identity lifecycle issue for IGA, PAM-adjacent oversight, and entitlement review, not just a procurement concern.
Key questions
Q: How should teams govern SaaS licences when users can sign up outside IT?
A: Teams need a discovery-backed system of record that reconciles SSO, finance, HR, and app integrations into one view of subscriptions and access. Without that, shadow IT remains invisible, renewals are guessed, and offboarding cannot reliably revoke what was never centrally tracked in the first place.
Q: Why do overlapping SaaS apps create more risk than simple budget waste?
A: Because each extra application adds its own identity boundary, permission model, and offboarding path. That fragmentation weakens governance even when the tools appear harmless. The practical risk is that users keep access in forgotten systems long after the business has stopped relying on them.
Q: What breaks when SaaS licenses are not revoked after employees leave?
A: Unrevoked licenses keep billing active and preserve access longer than business need requires. The failure is lifecycle control, because the organisation continues paying for subscriptions that no longer map to a current user or a current purpose. That is why offboarding and SaaS entitlement review need to be linked.
Q: How can organisations tell whether SaaS access governance is actually working?
A: They should look for three signals: low numbers of orphaned accounts, consistent entitlement recertification, and rapid revocation when users change roles or leave. If access remains valid across apps after a lifecycle event, governance is not working even if dashboards look complete.
Technical breakdown
Why SaaS spend becomes an identity governance problem
SaaS buying shifts control away from central IT when departments or individuals can subscribe directly with a credit card. Once that happens, the organisation loses a clean inventory of applications, users, and owners. The problem is not merely cost leakage. It is governance fragmentation: there is no dependable map between app access, business ownership, and renewal accountability. That gap matters because every unattended subscription becomes a standing entitlement with a financial footprint and an access footprint. In practice, spend management and entitlement governance converge on the same control point: knowing what exists before it can proliferate.
Practical implication: build a single inventory that ties every SaaS app to an owner, user group, and renewal date.
How duplicate apps and unused licenses create hidden access drift
Duplicate applications emerge when teams adopt overlapping tools for the same workflow, often outside IT standards. Unused licenses then accumulate because no one has a complete view of who actually consumes the service. This is an identity issue because license allocation is a form of access grant, and every unreviewed renewal extends that grant by default. The article’s logic also shows why spreadsheets fail at scale: they cannot keep pace with the pace of app adoption, offboarding, and renewal cycles. Without authoritative discovery, access and spend both drift away from policy intent.
Practical implication: use usage and ownership data to find duplicate services before each renewal cycle, not after the bill arrives.
Why auto-renewals and unmanaged offboarding create persistent entitlement debt
Auto-renewals turn temporary business need into persistent expenditure unless someone actively cancels or right-sizes the subscription. The same dynamic applies when employees leave and licenses are not revoked. That produces entitlement debt, a useful phrase for the accumulated cost and access residue left behind when app lifecycle controls are weak. The article shows that renewal notifications and usage metrics are the only practical way to prevent unattended extensions at scale. In governance terms, this is lifecycle management applied to SaaS entitlements, where the organisation must continuously confirm whether access still matches need.
Practical implication: tie offboarding and renewal review to the same control process so expired need triggers license removal.
Breaches seen in the wild
- SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
SaaS spend management is now part of identity governance, not a separate procurement discipline. The article shows that app purchasing, subscription renewal, and license assignment all create governance obligations that IGA teams already understand from access lifecycle work. When employees can adopt tools independently, the organisation needs the same discipline it uses for entitlements, ownership, and recertification. The practitioner conclusion is straightforward: if you cannot govern the application estate, you cannot govern the access estate.
Duplicate SaaS tools create an identity sprawl problem before they become a cost problem. Each redundant app introduces another identity boundary, another owner, and another renewal point that the organisation must track. That expands the attack surface for misaligned access and the operational surface for waste at the same time. The practitioner implication is that rationalising SaaS portfolios is an identity hygiene activity, not only a finance exercise.
Entitlement debt is the right named concept for unattended SaaS renewals and unrevoked licenses. Once a subscription auto-renews or remains active after business need ends, the organisation carries both financial residue and access residue forward. That residue is invisible until an audit, an invoice, or a security review forces it into view. Practitioners should treat renewal control as a lifecycle control problem with identity consequences, not as a periodic procurement task.
The shift from on-premise software to cloud-first buying has moved control from the network perimeter to the identity perimeter. Users can now create business value faster than central governance can observe it, which means inventory, ownership, and renewal accountability must be joined together. The old perimeter question was where software lived. The new one is who can create, keep, and retire access to it. The practitioner conclusion is that SaaS governance now belongs inside identity programmes.
Budget optimisation and access governance are converging on the same evidence set. Usage metrics, ownership records, and renewal dates are no longer just finance inputs. They are the operational evidence needed to decide whether an application should remain accessible, be consolidated, or be retired. That makes SaaS spend analytics directly useful to IAM, IGA, and access review teams. The practitioner conclusion is to design reporting once and use it for both cost control and entitlement control.
From our research library:
- The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.
- Read next: Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs
What this signals
Entitlement debt: every unattended subscription carries forward both cost and access residue, which is why SaaS governance belongs inside identity lifecycle management. Teams that only measure spend miss the more durable control problem: a license that remains active after need has ended still represents governed access that should have been retired.
The move to employee-led software adoption means IAM and IGA teams need procurement evidence, usage telemetry, and renewal ownership in the same control view. That is the only way to decide whether an application should be renewed, consolidated, or removed before the next billing event.
For practitioners
- Centralize SaaS inventory and ownership Maintain one authoritative record for every subscription, named owner, business unit, user group, and renewal date so app access and spending can be governed together.
- Review renewals before auto-renewal dates Require a formal business justification before each renewal and cancel services that no longer have current usage or an approved owner.
- Use usage metrics to right-size licenses Compare active users, feature consumption, and contract entitlements to remove unused, sub-optimal, and inactive licenses before the next billing cycle.
- Eliminate duplicate applications by function Map overlapping tools by use case, then consolidate departments onto the smallest set of approved services that meets the same business need.
- Tie offboarding to license revocation When an employee leaves or changes role, verify the subscriptions they used and revoke or reassign the associated licenses as part of the same workflow.
Key takeaways
- SaaS overspending in this article is framed as a governance failure, because access, ownership, and renewals drift when app buying is decentralised.
- The article points to duplicate apps, unused licenses, and unmanaged renewals as the main sources of waste and lifecycle risk.
- Identity teams should connect inventory, usage review, and offboarding to renewal decisions so subscriptions are retired before they become lingering entitlements.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Unused subscriptions and employee leavers create the offboarding gap described in the article. |
| NHI-05 — Overprivileged NHI | Unneeded licenses and duplicate access create entitlement excess across SaaS tools. | |
| NHI-07 — Long-Lived Secrets | Auto-renewing subscriptions persist by default unless lifecycle controls intervene. | |
| Recommendation — Tie SaaS offboarding to license revocation so inactive access is removed with the same workflow. Review SaaS entitlements regularly and remove licenses that exceed current business need. Set renewal controls that force explicit reapproval before a subscription continues. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about governing who still has access to SaaS services and why. |
| Recommendation — Apply entitlement reviews to SaaS subscriptions so access remains aligned to approved need. | ||
| CIS Controls v8 | CIS-5 — Account Management | SaaS licenses behave like managed accounts and need continuous ownership and removal control. |
| Recommendation — Maintain authoritative ownership and removal processes for every active SaaS subscription. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Right-sizing licenses is the access-minimisation problem described throughout the article. |
| Recommendation — Enforce least privilege across SaaS entitlements by eliminating unused and duplicated licenses. | ||
Key terms
- SaaS Spend Management: SaaS spend management is the practice of tracking, analysing, and reducing software subscription costs across an organisation. It combines usage data, renewal timing, and ownership information so teams can remove waste, renegotiate contracts, and align applications with business need.
- Entitlement debt: Entitlement debt is the accumulation of licenses, subscriptions, or accesses that remain active after the business need has faded. It combines financial waste with governance drift, because the organisation keeps paying for access that no longer has a clear owner or purpose.
- Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.
- Licence Right-Sizing: Licence right-sizing is the process of matching user entitlement to real business need so organisations do not pay for access they do not use. In governance terms, it also exposes over-provisioning that can widen risk and complicate audit evidence.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 11, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org