TL;DR: SaaS adoption is shifting software consumption to decentralized buying, access, and data ownership, and Zluri argues that traditional ITAM and SAM models cannot keep up with renewal, offboarding, and compliance demands. The identity problem is no longer just software sprawl, but unmanaged access lifecycles across users, data, and SaaS tools.
At a glance
What this is: This article argues that SaaS growth has made traditional ITAM and SAM too centralised for how software is now bought, accessed and governed.
Why it matters: It matters because IAM, IGA and SaaS owners now need lifecycle controls for access, renewal, offboarding and compliance, not just better asset inventory.
By the numbers:
- The cloud market has grown about 60x since 2008, according to Zluri.
- The cloud market was $375 billion in 2020, according to Zluri.
- SaaS is expected to reach $832.1 billion by 2025, according to Zluri.
Context
SaaS sprawl is a governance problem as much as a procurement problem. When business teams can buy applications directly, central IT loses the clean ownership model that traditional asset management assumed, and identity becomes the only reliable way to track who can access what.
The article argues that decentralised adoption breaks the old SAM and ITAM model because licences, data and access no longer move through one controlled path. That creates a practical gap between software inventory and identity governance, especially when onboarding, offboarding and compliance checks sit with the application rather than the platform.
For IAM and IGA teams, the important shift is that SaaS control is now lifecycle control. The question is no longer just how many apps exist, but whether access, renewal and termination are tied to governed processes that can follow the application wherever it spreads.
Key questions
Q: How should security teams handle SaaS applications that are bought outside IT?
A: They should bring those apps into a managed inventory, assign business ownership, and require renewal review before the contract continues. The goal is not only cost control. It is also making sure unsanctioned tools do not become unmanaged access paths that bypass lifecycle governance and create shadow IT risk.
Q: Why does SaaS sprawl make governance and compliance harder?
A: SaaS sprawl creates multiple independent storage and access decisions across departments, which breaks visibility and weakens auditability. Compliance gets harder because teams can no longer prove where regulated data lives or who can access it. The control problem is not volume alone. It is the lack of a single governance boundary for data and identity.
Q: What breaks when traditional SAM is used for SaaS environments?
A: Traditional SAM breaks because it assumes central procurement, stable ownership and predictable retirement paths. SaaS purchasing is often distributed, so the asset record no longer matches the access record, and licence management cannot reliably enforce lifecycle controls or compliance obligations.
Q: How can teams tell whether SaaS governance is actually working?
A: Look for evidence that discovered applications can be assigned an owner, tied to an access policy, and removed through an enforced workflow. If the platform can only report on SaaS usage but cannot drive deprovisioning or entitlement review, governance is still fragmented.
Technical breakdown
Why traditional SAM breaks in SaaS-first environments
Traditional Software Asset Management assumes software is centrally purchased, assigned and retired. SaaS reverses that model because users and teams can subscribe directly, often outside the IT gatekeeping process. That means licence ownership, access entitlement and usage tracking are no longer bound to a single procurement record. The technical failure is not simply that the inventory is incomplete. It is that the control plane was designed for packaged software and cannot natively model distributed subscription ownership, shadow procurement or account-level sprawl across many cloud services.
Practical implication: inventory alone is not enough, and governance must follow subscription ownership and access lifecycle, not just installed software.
Why access control becomes harder when SaaS is decentralised
In SaaS, access is granted inside each application, often through federated identities, local roles and separate admin workflows. When adoption is decentralised, onboarding and offboarding become fragmented across many systems, which makes revocation slow and inconsistent. That is why rogue access emerges even when the organisation has a central IAM stack. The problem is the mismatch between central identity policy and application-local entitlement management. Without a governed joiner-mover-leaver process that extends into SaaS apps, access can persist after a user changes role or leaves the business.
Practical implication: extend identity lifecycle controls into every SaaS app so revocation and role changes do not depend on manual app administration.
How SaaS sprawl turns compliance into an identity governance issue
Compliance risk in SaaS is often framed as a data problem, but the article points to a deeper issue: every application introduces its own access, retention and security obligations. If business units can adopt tools without central review, the organisation loses visibility into which systems hold sensitive data and who is accountable for them. That creates audit gaps around ownership, termination and policy enforcement. In practice, compliance in SaaS depends on identity governance spanning the application portfolio, because access and data control are inseparable once software buying is decentralised.
Practical implication: map SaaS applications to accountable owners and governance controls before auditors force the issue.
Threat narrative
Attacker objective: The practical objective is to exploit unmanaged SaaS access paths and data sprawl to gain or retain access beyond the organisation's intended governance boundary.
- Entry occurs through decentralised SaaS purchasing, where business users can adopt applications without central review or identity governance gates.
- Credential and access sprawl follow when onboarding and offboarding are handled inconsistently across many SaaS platforms, leaving residual access in place.
- Impact emerges as rogue users, unmanaged data exposure and compliance gaps accumulate across the SaaS estate.
Breaches seen in the wild
- SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Traditional asset management fails when software ownership becomes distributed: ITAM and SAM were built for centrally procured software, not for a world where business users can buy SaaS directly. Once procurement fragments, the asset record stops being the control record. The practitioner consequence is that SaaS governance has to move from inventory management to lifecycle governance.
Access lifecycle is the real control plane in SaaS: The article's core lesson is that onboarding, offboarding and privilege management are now the decisive controls, not licence counting. If access changes can happen in the app without a governed process, central IAM only sees part of the picture. Organisations should treat SaaS entitlement management as an identity programme, not a procurement afterthought.
Compliance breaks when application ownership is unclear: SaaS sprawl creates audit risk because no one can confidently answer which applications hold data, who owns them and how access is terminated. That is not just a SaaS hygiene problem. It is a governance defect that undermines accountability across security, legal and business teams.
Identity governance must extend to the buying model: Decentralised SaaS adoption changes the governance perimeter itself. The platform issue is not only who can log in, but who can introduce new software into the estate and on what basis. That makes shadow procurement a control problem, not just a finance issue, and practitioners need governance structures that cover both acquisition and access.
SaaS sprawl is a lifecycle problem, not a tooling problem: The durable concept here is identity lifecycle drift across application ownership, entitlement assignment and termination. Tools can discover apps, but only governance can keep access, accountability and compliance aligned once software buying is decentralised. Practitioners should optimise for lifecycle control rather than more static software inventory.
From our research library:
- The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.
What this signals
SaaS sprawl changes the control boundary: Once business teams can subscribe directly, the governance problem is no longer just asset visibility. The organisation has to control the access lifecycle, the approval path and the offboarding path for each application, or shadow adoption will keep outrunning central policy.
Identity teams should expect procurement pressure to become governance pressure: The same decentralisation that makes SaaS easy to buy also makes it hard to revoke, review and reconcile. That means SaaS management needs to sit alongside IAM and IGA, not beside finance alone.
For practitioners
- Map SaaS ownership to accountable business and IT owners Create a live register that ties each SaaS application to a named owner for procurement, access, data and offboarding decisions. Without explicit ownership, renewal and termination decisions stay informal and governance cannot be enforced consistently.
- Extend joiner-mover-leaver processes into SaaS apps Make onboarding, role change and offboarding workflows trigger entitlement updates inside each high-value SaaS platform, not just in the directory. Reconcile local application roles against central identity records on a recurring basis.
- Track renewal and termination as identity controls Treat subscription renewal, cancellation and license reclamation as lifecycle events that remove access and reduce data exposure, not only as finance tasks. Tie renewal approvals to current usage and business justification.
- Inventory data-bearing SaaS before expanding adoption Classify SaaS tools by the type of data they store, share or process, then decide what access, review and offboarding controls each class requires. Prioritise applications that hold sensitive or regulated information.
- Build shadow SaaS detection into governance reviews Compare expense, procurement and SSO data to find applications that were adopted outside the normal approval path. Feed those findings into access review and ownership cleanup so unmanaged apps do not persist.
Key takeaways
- SaaS adoption creates a governance gap when buying, ownership and access decisions move away from central IT.
- The article shows that decentralised app usage undermines old software asset models because access and compliance now live inside the application estate.
- The practical response is to manage SaaS as lifecycle governance, with ownership, offboarding and entitlement reconciliation built into the process.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | SaaS offboarding is central because unmanaged apps retain access after users leave or change role. |
| NHI-05 — Overprivileged NHI | Decentralised SaaS administration often leaves excessive access inside individual apps. | |
| Recommendation — Tie SaaS offboarding to access revocation and app ownership so stale accounts do not persist. Review SaaS roles for excess privilege and remove permissions that exceed business need. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about governing who can access which SaaS applications and data. |
| Recommendation — Apply PR.AA-05 to align SaaS entitlements with approved access and ownership records. | ||
| CIS Controls v8 | CIS-5 — Account Management | SaaS sprawl creates account lifecycle and revocation problems across many applications. |
| Recommendation — Use CIS-5 to inventory SaaS accounts and remove dormant or unauthorised access. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The piece highlights access creep in SaaS platforms where privileges are often broader than needed. |
| Recommendation — Enforce AC-6 across SaaS roles so each user receives only the access required for the task. | ||
Key terms
- SaaS Sprawl: SaaS sprawl is the uncontrolled spread of software-as-a-service applications across teams and business units. It creates fragmented ownership, duplicated functionality, and weak visibility into who can access what. For IAM and NHI teams, the main risk is not only cost but persistent entitlements that outlive business need.
- Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
- Joiner-Mover-Leaver Lifecycle: The joiner-mover-leaver lifecycle describes the access changes that should happen when a person or account is created, changes role, or exits the organisation. It is the basic operating model for keeping entitlements aligned to current need, and it becomes critical when automation replaces manual ticket handling.
- Application entitlement: Application entitlement is the permission or access level a user, app, or service has within a software system. It matters because entitlement determines what data can be reached, changed, or deleted, and stale entitlements can remain active long after the original need has disappeared.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 12, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org