TL;DR: SaaS cost optimisation starts with visibility, because duplicate apps, forgotten auto-renewals, and over-tiered licences quietly drain budget and create unmanaged access paths, according to Zluri. The governance lesson is that spend control and identity control are now the same operating problem, especially where unsanctioned apps sit outside IT review.
At a glance
What this is: This article argues that SaaS cost optimisation starts with discovery because duplicate apps, unused subscriptions, auto-renewals, and oversized licences create waste and hidden access risk.
Why it matters: For IAM and governance teams, the same SaaS visibility work that reduces spend also exposes unsanctioned access paths, orphaned subscriptions, and licence misalignment across the application estate.
Context
SaaS sprawl is the condition where applications are purchased faster than they are inventoried, governed, or retired. In identity terms, that means access is often created at the point of need and then left behind when the app or subscription is no longer actively used.
The governance problem is not only financial waste. When employees can buy and keep using tools outside IT review, the organisation loses sight of who has access, which subscriptions are live, and which entitlements still map to business need.
Key questions
Q: How should security teams govern access across SaaS sprawl?
A: Security teams should govern SaaS sprawl with one inventory, one policy model, and one review process that covers both human and non-human access. The practical goal is to connect application approval, entitlement review, and revocation to business ownership. Without that linkage, access governance becomes a manual cleanup exercise instead of a control system.
Q: Why do auto-renewing SaaS subscriptions create access risk?
A: Because renewal extends a service without a fresh decision about who should still have access. That means an old business justification can keep a subscription alive long after the user, team, or workflow has changed. The result is standing access that survives by default rather than by approval.
Q: What are the signs that SaaS licence rightsizing is failing?
A: Common signs include premium tiers with low feature use, multiple apps serving the same function, and subscriptions that renew without owner review. Those patterns show the organisation is paying for capability it does not need while losing sight of the identity and access footprint tied to the app estate.
Q: What should organisations do when employees buy SaaS outside IT review?
A: Decide whether the subscription should be sanctioned, replaced, or revoked, and make that decision part of the procurement and access lifecycle. If employees can buy tools independently and keep using them, the organisation needs a formal intake process so unauthorised software does not become unmanaged access.
Technical breakdown
Why SaaS discovery is the control plane
SaaS discovery is the process of building an inventory of applications from multiple sources such as SSO, APIs, finance systems, browser activity, and desktop telemetry. Without that inventory, teams cannot distinguish sanctioned access from shadow usage, or active subscriptions from dormant ones. Discovery is therefore not just asset management. It is the prerequisite for lifecycle control across applications, users, and spend.
Practical implication: establish a single SaaS inventory before attempting optimisation, renewal, or access review decisions.
How duplicate applications create governance drift
Duplicate applications appear when different teams adopt tools with overlapping features and no one reconciles functional redundancy. That creates governance drift because usage, ownership, and entitlement patterns fragment across parallel apps. The result is not only wasted licence spend but also multiple access paths to the same business function, each with its own renewal and offboarding problem.
Practical implication: map overlapping SaaS functions to named business owners and eliminate unmanaged duplication from the stack.
Why auto-renewals and tier rightsizing are identity issues
Auto-renewals extend access and payment without a fresh business decision, which means a subscription can outlive the need that justified it. Tier rightsizing is the act of aligning licence level to actual feature use and job role. Together, they show that cost control and entitlement control are the same operational problem when SaaS access is tied to a paid subscription.
Practical implication: pair renewal review with entitlement review so licences are cancelled or downgraded before the next billing cycle.
Threat narrative
Attacker objective: The objective is not a classic external breach but the accumulation of unmanaged subscriptions and hidden access paths that increase cost and governance exposure.
- Entry occurs when employees procure SaaS tools directly with corporate payment methods outside IT review, creating an unsanctioned access path from the start.
- Credential or subscription persistence occurs when auto-renewal keeps the service active after the original business need has faded, preserving access without a new approval.
- Impact occurs when duplicate tools, unused licences, and unmanaged subscriptions accumulate cost waste and obscure which users still have valid access to what applications.
Breaches seen in the wild
- SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
SaaS sprawl is an identity governance problem before it is a procurement problem. The article shows that buying, renewing, and downgrading software all depend on knowing who can access what and whether that access is still justified. Once app ownership fragments across departments, licence control and access control stop being separate disciplines. The practical conclusion is that SaaS inventory must be governed as part of the identity programme, not as a finance side task.
Auto-renewal turns temporary access into standing access. A subscription that renews without a new business decision creates the same governance problem as any persistent entitlement: no one revalidates need before the access continues. That makes renewal calendars and usage evidence part of the identity lifecycle, not just the finance workflow. Practitioners should treat renewal oversight as a control over access persistence, not just spend leakage.
Licence tiering is a proxy for entitlement precision. Over-tiered subscriptions often reveal that teams do not actually understand feature usage by role, department, or app owner. When that is true, the organisation is likely over-granting access in other systems too. The wider lesson is that optimisation exercises can expose entitlement quality gaps that recertification alone will miss.
Hidden SaaS use is a form of shadow access surface. If employees can subscribe independently and keep using tools outside IT visibility, the organisation has no reliable boundary between sanctioned and unsanctioned access paths. That makes discovery and renewal governance part of the same control story as access review, because both are trying to answer who really has access in the live environment. The practitioner takeaway is to govern the application estate as an identity surface, not just a software catalogue.
From our research library:
- The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.
What this signals
SaaS sprawl is a governance boundary problem. Once teams can adopt applications faster than they can inventory them, renewal decisions become a proxy for identity decisions. Practitioners should assume that any subscription not tied to an owner, a usage signal, and a renewal review will drift into hidden access.
Renewal control is lifecycle control. The article makes clear that cancellation dates, usage data, and licence tiers all belong in the same operating model. That is the right signal for IAM and governance teams: if a subscription can persist without revalidation, access has already become standing by default.
For practitioners
- Build a central SaaS inventory Aggregate SSO, API, finance, browser, and endpoint signals into one authoritative application list so teams can see sanctioned and unsanctioned use together.
- Review every renewal against actual usage Require app owners to confirm active usage, business need, and renewal approval before subscriptions roll over automatically.
- Eliminate duplicate applications by function Group apps by shared business capability, assign an owner for each capability, and retire tools that duplicate an approved service.
- Rightsize licences to matched tiers Compare feature consumption to licence level and downgrade users who do not need premium functions before the next billing event.
- Separate employee spend from approved procurement Flag subscriptions bought on corporate cards or expense reports so IT can decide whether to sanction, replace, or revoke them.
Key takeaways
- SaaS sprawl creates both financial waste and hidden access exposure when apps are bought, renewed, and retained outside a governed inventory.
- The article's central control theme is visibility, because usage data and ownership data are what let teams separate active, sanctioned services from dead weight.
- The most practical response is to link discovery, renewal review, and licence rightsizing into one identity-aware operating process.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Dormant SaaS subscriptions persist when cancellation and offboarding are not governed. |
| NHI-07 — Long-Lived Secrets | Auto-renewing subscriptions preserve access longer than the business need that created them. | |
| Recommendation — Tie app retirement and subscription cancellation to NHI offboarding controls. Review long-lived SaaS access paths and remove standing subscriptions before renewal. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about aligning SaaS entitlements with actual business use. |
| Recommendation — Validate SaaS entitlements against current business need and revoke excess access. | ||
| CIS Controls v8 | CIS-5 — Account Management | The post centres on managing who can keep using applications and subscriptions over time. |
| Recommendation — Maintain authoritative application ownership and remove unused SaaS accounts and subscriptions. | ||
| MITRE ATT&CK | TA0006;TA0040 — Credential Access; Impact | Unmanaged SaaS access paths expand exposure and produce cost and governance impact. |
| Recommendation — Map unmanaged SaaS usage to exposure and impact pathways in detection and response planning. | ||
Key terms
- SaaS Sprawl: SaaS sprawl is the uncontrolled spread of software-as-a-service applications across teams and business units. It creates fragmented ownership, duplicated functionality, and weak visibility into who can access what. For IAM and NHI teams, the main risk is not only cost but persistent entitlements that outlive business need.
- Automatic Renewal: Automatic renewal is a contract mechanism that extends a SaaS subscription at the end of the term unless someone cancels or renegotiates it. In practice, it can preserve convenience while also locking in avoidable spend if teams do not review usage, value, and renewal timing in advance.
- License rightsizing: The process of matching purchased SaaS seats or tiers to real consumption. Rightsizing is more than cost cutting because it also exposes overprovisioned access, underused features, and subscriptions that should be downgraded or reclaimed before they roll into another billing cycle.
- SaaS Discovery: SaaS discovery is the process of identifying all sanctioned and unsanctioned software-as-a-service applications in use across the organisation. It matters because cloud assurance increasingly depends on seeing where apps share data, what permissions they hold, and which identities can reach them.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 11, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org