SaaS sprawl and renewal leaks are driving avoidable spend waste

At a glance

What this is: This article argues that SaaS sprawl, underused licenses, and auto-renewals are driving waste because organisations lack reliable visibility into app usage, ownership, and contract timing.

Why it matters: It matters to IAM and IGA teams because SaaS spend leakage is tightly linked to identity governance, especially app ownership, user engagement, and offboarding discipline across human and machine-connected services.

Context

SaaS spend waste is often an identity governance problem in disguise. When organisations cannot tie applications to active users, owners, departments, and renewal dates, they lose the evidence needed to rightsize licences, stop duplicate subscriptions, and challenge unnecessary renewals.

The article frames SaaS management as a way to recover control over dispersed application estates created by hybrid work and shadow IT. For IAM and IGA teams, the useful question is not only how much software is being bought, but whether identity-linked usage data is strong enough to support renewal decisions and offboarding decisions.

The governance failure is usually not one dramatic control gap. It is the accumulation of small blind spots, such as redundant apps, unused licences, and auto-renewals that continue because no one owns the cancellation decision.

Key questions

Q: How should teams stop SaaS apps from being renewed after the business no longer needs them?

A: Teams should require owner confirmation, usage evidence, and finance approval before every renewal. The practical control is a renewal workflow that checks active users, business need, and contract status together. Without that checkpoint, subscriptions keep renewing even when the app has become abandoned or duplicated.

Q: Why do unused SaaS licences keep creating cost even when teams stop using the app?

A: Because subscription renewals continue unless someone actively intervenes. If ownership is unclear, the contract renews, the licence remains allocated, and the organisation keeps paying for capacity that no longer produces value. This is a lifecycle failure, not just a budgeting issue.

Q: What are the signs that SaaS app sprawl is becoming a control problem?

A: The main warning signs are unapproved apps appearing across teams, inconsistent access policies, and a growing gap between what employees use and what security can see. Another signal is fragmented ownership, where no team can explain who approved an app, what data it touches, or how access is revoked when it is no longer needed.

Q: Should organisations prioritise licence rightsizing or renewal controls first?

A: Renewal controls usually come first because they stop waste from continuing by default. Rightsizing is still important, but it has less value if contracts keep renewing before the business has a chance to act. The best sequence is to control renewal decisions, then refine licence allocation with better usage evidence.

Technical breakdown

Why SaaS discovery fails without identity-linked telemetry

SaaS discovery is only useful when it can connect apps to real usage signals. Identity data from SSO, finance feeds, browser activity, device presence, and APIs gives IT teams a fuller picture of what is actually in use. Without that correlation, app inventories become partial and renewal decisions rely on invoices or local team memory rather than governance evidence. The article shows that discovery is not simply about counting apps. It is about establishing whether a licence is tied to an active user, a dormant account, or a duplicate service. That distinction determines whether spend is legitimate or wasted.

Practical implication: Treat SaaS discovery as an identity correlation problem, not a software inventory exercise.

How auto-renewals create hidden spend leakage

Auto-renewals become a governance problem when subscriptions continue after a project ends or a team stops using a tool. The technical issue is not the billing mechanism itself, but the absence of a controlled owner-review workflow before renewal triggers. If renewal dates, contract terms, and usage signals are not joined in one process, cancelled business need and active subscription state drift apart. The article’s example of unused project management software renewing monthly is typical of how spend leaks persist in SaaS estates. The control failure is a missed opportunity to evaluate continued business need before the contract rolls over.

Practical implication: Build renewal review into ownership and access governance so unused apps can be exited before auto-renewal.

Why licence rightsizing depends on usage measurement

Licence rightsizing requires more than knowing how many seats were purchased. Teams need active-user counts, feature usage, departmental allocation, and contract cost to identify which subscriptions are underused or overprovisioned. In practice, a seat that is technically assigned but not meaningfully used is still spend waste if the renewal process never reassesses it. The article highlights that unused and overlapping licences can be surfaced only when usage data is measured consistently across the SaaS estate. That makes spend management dependent on the same evidence quality that identity governance uses for access reviews: who has access, who is actually using it, and whether the assignment still makes sense.

Practical implication: Use usage thresholds and ownership checks to rightsize licences before the next contract decision.

Threat narrative

Attacker objective: The objective is not external compromise but sustained financial waste through unmanaged SaaS subscriptions and avoidable renewal spend.

1. entry via uncontrolled SaaS adoption and shadow IT, where teams procure applications outside central oversight without consistent ownership or lifecycle review.
2. credential and subscription persistence through dormant licences and forgotten renewals, which keeps access and spend active after business use has dropped.
3. impact through recurring budget leakage, duplicate tools, and delayed negotiation leverage that accumulates across departments and contract cycles.

Breaches seen in the wild

• SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

SaaS spend waste is an identity governance failure before it is a finance problem: when organisations cannot connect applications to users, owners, and renewal points, they lose the control plane needed to govern lifecycle decisions. The article shows that duplicated tools and unused licences persist because the identity layer is missing from spend management. The practitioner conclusion is that SaaS optimisation must be treated as part of IAM and IGA, not as a standalone procurement clean-up.

Auto-renewal is the spend equivalent of standing privilege: once a subscription renews without active reassessment, cost continues by default and business justification becomes optional. That mirrors the governance risk seen in long-lived access, where nothing forces revalidation before the entitlement persists. The implication is that renewal authority needs ownership, evidence, and a review point, or recurring waste will keep outlasting the work that justified the app.

App usage visibility is the named concept that changes the control model: if you cannot see who is using an application, you cannot tell whether a licence is operational value or pure drag. The article’s emphasis on 60-day engagement, departmental spend, and renewal alerts shows that utilisation data is the deciding signal. The practical conclusion is that renewal decisions should be based on measured usage, not on purchase history or vendor cadence.

Department-led buying fragments accountability faster than most enterprises realise: when teams procure tools independently, each subscription carries a local justification that may never be rechecked centrally. The result is overlapping functionality, weak cancellation discipline, and limited leverage at renewal. This is exactly where identity governance should intervene, because ownership and offboarding discipline are the only durable way to stop the same application from being paid for long after its value has expired.

SaaS rationalisation is now a continuous governance process, not a periodic savings exercise: the pattern in the article shows that spend leakage accumulates from many small renewal and usage gaps rather than one large error. That means control effectiveness depends on recurring visibility into adoption, cost, and ownership. The practitioner conclusion is to manage SaaS as a lifecycle problem with ongoing recertification, not a one-time contract review.

From our research library:

• The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.

What this signals

App usage visibility is becoming a governance control, not an optimisation nice-to-have: when SaaS estates grow faster than ownership discipline, the key risk is not just overspend but unmanaged lifecycle drift. Teams need a way to prove whether an app is still delivering value before the next contract event, because renewal decisions without usage evidence are just expense continuation.

The strongest signal in this article is that budget pressure exposes weak accountability rather than weak procurement alone. When departments can buy, adopt, and forget tools independently, the organisation ends up paying twice: once for redundant software and again for the time needed to unwind it. That makes SaaS governance part of identity lifecycle management, not a separate savings programme.

For practitioners

• Map every SaaS app to an accountable owner Require a named business and technical owner for each application so renewal, cancellation, and usage review decisions have a clear decision-maker.
• Join usage data to renewal calendars Combine active-user counts, feature usage, and contract dates in one workflow so teams can challenge renewals before auto-renewal triggers.
• Rightsize licences using engagement thresholds Set a review rule for seats that have low or no activity over a defined period and remove or downgrade them before the next renewal cycle.
• Consolidate overlapping tools by function Identify apps with the same business purpose across departments and retire duplicates where one service already covers the required workflow.
• Build pre-renewal approval into spend governance Make high-value renewals require an explicit reassessment of business need, usage, and vendor cost before the contract rolls over.

Key takeaways

• SaaS sprawl becomes wasteful when organisations cannot connect applications to active users, owners, and renewal timing.
• The article shows how low engagement, duplicate tools, and forgotten renewals compound into recurring budget leakage across departments.
• The most effective control is a governed renewal review that uses identity-linked usage data before contracts auto-renew.

Key terms

• SaaS Sprawl: SaaS sprawl is the uncontrolled spread of software-as-a-service applications across teams and business units. It creates fragmented ownership, duplicated functionality, and weak visibility into who can access what. For IAM and NHI teams, the main risk is not only cost but persistent entitlements that outlive business need.
• Automatic Renewal: Automatic renewal is a contract mechanism that extends a SaaS subscription at the end of the term unless someone cancels or renegotiates it. In practice, it can preserve convenience while also locking in avoidable spend if teams do not review usage, value, and renewal timing in advance.
• License rightsizing: The process of matching purchased SaaS seats or tiers to real consumption. Rightsizing is more than cost cutting because it also exposes overprovisioned access, underused features, and subscriptions that should be downgraded or reclaimed before they roll into another billing cycle.
• Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.