TL;DR: SaaS spend management becomes a control problem, not just a finance problem, because unused licenses, auto-renewals, and orphaned accounts are all tied to identity lifecycle gaps, according to Josys. The operational fix is continuous discovery, access review, and offboarding-linked deprovisioning, because spend waste and access risk usually share the same root cause.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Josys's blog post: SaaS spend management is presented as an identity governance problem, with unused licenses and orphaned accounts usually stemming from the same lifecycle gaps.
Why it matters: IAM and IGA teams should treat software waste as a control signal, because license recovery, access review, and deprovisioning are the same governance workflow in different forms.
By the numbers:
- In practice, Josys typically finds around 25% of SaaS spend is going to waste.
Context
SaaS spend control fails when organisations treat software cost as a finance-only issue instead of an identity lifecycle issue. Licenses are assigned to people, continue billing after people leave, and often survive outside the visibility of procurement or finance tools. For IAM and IGA teams, that means SaaS waste is frequently a symptom of weak discovery, weak offboarding, or weak ownership.
The article’s core problem is not budget pressure in isolation. It is the lack of a continuous control plane that connects application discovery, license usage, renewal decisions, and deprovisioning. Where that link is missing, SaaS costs rise quietly and access risk accumulates at the same time.
Key questions
Q: Why do SaaS sprawl and identity governance fail in the same place?
A: They both depend on discovery happening before control. If applications are only found at purchase or SSO integration, finance cannot manage spend early and security cannot govern access early. The shared failure is late visibility, which turns both disciplines into cleanup functions instead of preventive ones.
Q: Why do orphaned SaaS subscriptions create security risk?
A: Orphaned subscriptions create risk because they leave live access paths in place after the organisation has stopped using them. That produces unnecessary exposure, complicates offboarding, and can undermine compliance because security teams cannot prove that dormant access was actually removed.
Q: How do organisations know if SaaS licence cleanup is actually working?
A: They should see a shrinking gap between seats purchased and seats with meaningful activity, plus fewer renewals approved without usage evidence. Effective programmes also show faster revocation at offboarding and fewer apps discovered outside procurement. If those signals do not move, the control is not embedded.
Q: Should organisations treat SaaS renewal decisions as an access review?
A: Yes. Renewal is the right moment to confirm business value, active usage, user ownership, and entitlement scope. If a tool still matters, recertify its users and admin roles. If it does not, decommission the subscription and remove the access paths that came with it.
Technical breakdown
Why SaaS spend drifts without identity governance
SaaS cost drift happens because the control point sits after purchase, not before it. A seat can be added by a manager, renewed automatically by contract logic, and retained after an employee leaves, while no single system reconciles entitlement, usage, and ownership. This is fundamentally different from one-time procurement oversight. The governance failure is that the licence is treated as a financial line item instead of a live access grant tied to an identity lifecycle.
Practical implication: build a license governance view that joins identity status, application usage, and renewal dates.
How application discovery changes the control model
Finance records show what was bought, not what is actually in use. Discovery from SSO logs, OAuth grants, and browser signals reveals shadow IT and uncovers apps that never appear in invoice-led processes. That matters because unmanaged apps create both overspend and unreviewed access paths. Once the app inventory is anchored in identity signals, spend management and access governance start working from the same dataset rather than two disconnected records.
Practical implication: use identity-side discovery to validate the real SaaS stack before attempting cleanup or consolidation.
Why renewal automation matters more than annual cleanup
Auto-renewal is the mechanism that turns temporary waste into recurring waste. If renewal is handled manually once a year, the organisation usually learns too late to right-size tiers, cancel idle tools, or reclaim seats with no activity. A standing renewal calendar, ownership assignment, and deprovisioning linkage turn the renewal date into a control point rather than an accounting event. This is where identity governance converts cost review into prevention.
Practical implication: place renewal alerts and offboarding-triggered revocation in the same operational workflow.
NHI Mgmt Group analysis
Identity lifecycle, not procurement, is the real control boundary: SaaS spend grows when access ownership, renewal ownership, and lifecycle ownership are split across teams. That split allows wasted seats to persist after the human identity has changed status, which means the organisation has turned a governance problem into a recurring charge. The practical conclusion is that SaaS cost control belongs inside identity governance, not beside it.
License waste and orphaned access are the same failure seen from two angles: A seat that should have been removed but was not is simultaneously a spend leak and an access leak. That overlap matters because it lets IAM and finance teams work from a shared control objective instead of separate reporting goals. The named concept here is orphaned access spend, and it describes recoverable cost created by identities that no longer justify entitlement. Practitioners should measure it as a lifecycle control failure, not just a usage anomaly.
Continuous discovery is now a governance requirement for SaaS estates: Finance-led inventories will always lag reality because they miss free tiers, personal-card purchases, and departmental buying. Identity-side discovery changes that by tying actual application use back to users, SSO events, and delegated access paths. For identity programmes, that means SaaS visibility is not a nice-to-have reporting layer; it is the discovery foundation for entitlement control.
Offboarding has become a cost-control mechanism as much as a security control: The article shows that revoking access the day someone leaves stops both residual risk and recurring expense. That creates a stronger business case for lifecycle automation than either finance or security can make alone. The practitioner takeaway is to treat deprovisioning as a shared control for IAM, IGA, and SaaS spend reduction.
Quarterly governance beats annual cleanup for SaaS estates: Contract drift, headcount churn, and app sprawl move too quickly for annual review cycles to stay current. The control objective is therefore not perfection, but a cadence that catches renewal risk while there is still time to act. Practitioners should design the review rhythm around change velocity, not calendar convenience.
From our research library:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Read next: Top 10 NHI Issues
What this signals
Orphaned access spend: SaaS programmes now need to treat wasted licenses as an identity lifecycle symptom, not a purchasing mistake. When access ownership and contract ownership diverge, renewal noise becomes a governance signal. Practitioners should align renewal review with joiner-mover-leaver control so that licence recovery and deprovisioning happen in the same workflow.
The strongest SaaS control is still a joined inventory that combines application discovery, entitlement ownership, and revocation status. That inventory needs to be refreshed often enough to catch shadow applications before the next renewal cycle.
The 92% of organisations that expose NHIs to third parties, according to the Ultimate Guide to NHIs, is a reminder that third-party access and delegated software use should be reviewed with the same lifecycle discipline as human access.
For practitioners
- Map every SaaS app to a named identity owner Build a single inventory that joins application name, business owner, license count, renewal date, and the identities holding access so renewals and entitlement review use one dataset.
- Use identity-side discovery to find shadow SaaS Correlate SSO logs, OAuth grants, and browser activity to identify applications that never appeared in finance records, including free tiers and departmental purchases.
- Reclaim seats based on 90-day activity Separate zero-activity seats from low-activity seats and over-tiered seats, then reclaim or downgrade only where usage evidence supports the action.
- Tie deprovisioning to offboarding Automate license revocation when employment ends so departed users do not keep billing after access is removed, and so manual follow-up is not required.
- Create a renewal calendar with decision ownership Set renewal alerts well before contract dates, assign a decision owner for each contract, and require usage evidence before auto-renewal can proceed.
Key takeaways
- SaaS spend management becomes an identity governance problem when licences remain tied to identities that no longer need them.
- The same weak lifecycle control that creates idle seats also leaves orphaned accounts active and renewals on autopilot.
- The operational fix is a joined process for discovery, access review, offboarding, and renewal approval.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Departed users keeping SaaS seats active is the article's core governance failure. |
| NHI-05 — Overprivileged NHI | Over-tiered and unnecessary SaaS entitlements mirror excessive identity privilege. | |
| Recommendation — Automate offboarding-linked deprovisioning so SaaS seats are removed when identity status changes. Review SaaS entitlements against actual use and downgrade any access that exceeds business need. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article centres on lifecycle control over access credentials and linked entitlements. |
| Recommendation — Apply authenticator management to align SaaS credential and access revocation with offboarding. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The post is about governing who has access to SaaS applications and whether that access is still justified. |
| Recommendation — Continuously review SaaS entitlements and remove access that is no longer justified. | ||
| CIS Controls v8 | CIS-5 — Account Management | SaaS waste and orphaned accounts both point to weak account lifecycle management. |
| Recommendation — Centralise account lifecycle management so inactive SaaS accounts and seats are reclaimed quickly. | ||
Key terms
- SaaS Spend Management: SaaS spend management is the practice of tracking, analysing, and reducing software subscription costs across an organisation. It combines usage data, renewal timing, and ownership information so teams can remove waste, renegotiate contracts, and align applications with business need.
- Orphaned Account: An orphaned account is an identity that remains active without a clear owner or business purpose. These accounts are dangerous because they often escape review, retain unnecessary access, and provide attackers with low-friction entry points into otherwise governed environments.
- Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.
- Licence Right-Sizing: Licence right-sizing is the process of matching user entitlement to real business need so organisations do not pay for access they do not use. In governance terms, it also exposes over-provisioning that can widen risk and complicate audit evidence.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity lifecycle controls to the wider security outcomes their programmes need.
Published by the NHIMG editorial team on September 16, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org