SaaS sprawl is widening the identity and compliance gap

At a glance

What this is: This interview looks at how SaaS sprawl, shadow IT, integrations and APIs make it harder to prove compliance and govern access across the modern identity surface.

Why it matters: It matters because IAM and security teams now have to govern apps, connections and data movement, not just users, making inventory and access visibility foundational to compliance and control.

Context

SaaS sprawl is a governance problem as much as a security problem. When business users can sign up for applications directly, the organisation loses reliable inventory, access oversight and a clean view of where data is moving.

In this interview, Zluri describes why that matters for GDPR, shadow IT and access control. The key issue is not only that more apps exist, but that modern SaaS connectivity creates identity and compliance gaps across the application layer, the data layer and the access layer.

Key questions

Q: How should security teams govern access across SaaS sprawl?

A: Security teams should govern SaaS sprawl with one inventory, one policy model, and one review process that covers both human and non-human access. The practical goal is to connect application approval, entitlement review, and revocation to business ownership. Without that linkage, access governance becomes a manual cleanup exercise instead of a control system.

Q: Why do SaaS environments create compliance risk when user access and integrations are not centrally controlled?

A: SaaS environments create risk because access, configuration, and third party integrations can drift faster than teams can review them. When permissions are spread across interconnected apps, organisations lose sight of who can do what, where authentication is enforced, and which integrations expand exposure. That blind spot makes it harder to detect excessive privilege, document controls, and respond before gaps become findings.

Q: What breaks when shadow IT sits outside identity governance controls?

A: Access reviews, offboarding, and privileged approval workflows lose reliability when shadow IT is outside the system of record. The main failure is not the existence of extra tools, but the inability to inventory, classify, and revoke the identities and entitlements tied to them. That leaves unmanaged access in place even when governance activity appears to be working.

Q: How do you govern SaaS access without relying on the corporate network boundary?

A: Shift the control point from the network perimeter to the application relationship. Governance should focus on which identities can reach which SaaS service, from which device context, through which connector, and under what business approval. That model is more realistic than assuming the office network still defines trust.

Technical breakdown

Why SaaS inventory breaks identity governance

SaaS changes the unit of governance from a handful of centrally managed applications to a constantly shifting app estate. Users can create accounts, connect tools and authorise integrations without going through procurement or IT, which means the authoritative inventory is no longer the one in the CMDB or the IAM directory. In practice, identity governance depends on knowing which applications exist, which users and service accounts can reach them, and which connections can move data between them. Without that map, access reviews and compliance attestations become incomplete by design.

Practical implication: build continuous discovery for SaaS applications, not periodic spreadsheet-based reviews.

How APIs and integrations widen the compliance gap

APIs and app integrations extend trust beyond the login event. Once a connector is authorised, data can flow between systems in ways users do not see and security teams may not track. That matters for GDPR because compliance depends on understanding processing paths, not just securing a front door. The hidden risk is that an integration can outlive the original business need, continue to move data, or expose more fields than the owning team intended. Traditional IAM covers authentication and authorisation, but it often stops short of governing the downstream data movement created by SaaS connectivity.

Practical implication: treat integrations as governed access paths and review them with the same discipline as user entitlements.

Why elevated access and shadow IT become one control problem

Shadow IT and elevated access reinforce each other. A department may adopt a new SaaS tool outside formal controls, then grant broad admin rights to make it usable quickly, especially if the app does not fit existing workflows. That creates a control gap across inventory, privilege and assurance at once. In NHI terms, the same pattern also applies to app credentials, tokens and API connections that are provisioned ad hoc and then forgotten. The security issue is not simply that there are more tools, but that every unmanaged tool increases the number of identities and permissions the programme must govern.

Practical implication: include SaaS admins, app tokens and connector permissions in entitlement and access review scopes.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

SaaS sprawl turns identity governance into an inventory problem first. When teams cannot reliably enumerate what has been adopted, they cannot prove who has access to what or which systems are carrying regulated data. That is not a tooling gap alone, it is a governance gap created by decentralised procurement and freemium adoption. The practitioner conclusion is simple: no inventory means no defensible access governance.

GDPR evidence breaks down when data flows are hidden inside integrations. The article’s central warning is that connectivity, not just storage, determines where personal data travels. Traditional IAM can authenticate users and authorise apps, but it does not by itself explain what an API connector can extract, forward, or retain. Practitioners need to recognise that compliance evidence now depends on application relationships as much as on user records.

Unmanaged SaaS creates a shadow identity layer that sits outside the directory. Every forgotten app introduces its own admins, service accounts, tokens and access paths, which means the identity surface expands faster than the governance model built to control it. Shadow SaaS identity sprawl: this is the control plane gap where app inventory, entitlements and data movement become inseparable. The practitioner conclusion is to govern the app estate as part of identity architecture, not as a separate IT hygiene exercise.

The old perimeter model fails because access is now self-service and ambient. Users can reach corporate data from unmanaged devices and connect new SaaS services without a build request or an install ticket. That collapses assumptions behind central approval, static inventory and device-bound trust. The practitioner conclusion is that access policy must follow the application relationship, not the office network boundary.

Security awareness is not a substitute for SaaS governance. Training helps reduce risky user behaviour, but it cannot inventory shadow IT, constrain API grants or revoke forgotten integrations. That distinction matters because compliance failures here are structural, not purely behavioural. The practitioner conclusion is to treat training as supporting control, while the primary control remains discovery, entitlement review and connection monitoring.

From our research library:

• The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.

What this signals

Shadow SaaS identity sprawl: governance now has to account for application inventory, connector permissions and data movement as one control surface. If those elements are reviewed separately, the programme will always undercount exposure and overstate compliance.

Access review cycles built for stable application estates struggle when business users can create and connect tools on demand. The operational signal to watch is not just new apps, but unreviewed integrations that can continue processing data long after the original business need has changed.

For practitioners

• Continuous discovery of the SaaS estate Establish always-on discovery that captures sanctioned apps, shadow IT, connected integrations and the accounts behind them. Use this inventory as the starting point for entitlement review and compliance evidence.
• Review integrations as governed access paths Add API connections, OAuth grants and app-to-app links to the same review cycle used for privileged access. Validate which data each connector can reach, what business owner approved it, and whether the connection is still needed.
• Include SaaS admins in privilege reviews Map who can administer each application, who can create connectors, and who can export data. Fold those permissions into recertification so elevated access in SaaS tools is not invisible to IAM.
• Align GDPR evidence to data movement Document where personal data enters, which SaaS services process it, and which integrations can forward it elsewhere. Use that evidence to close the gap between application inventory and compliance claims.

Key takeaways

• SaaS sprawl is not only an IT inventory problem. It creates a governance gap where applications, integrations and access paths escape normal identity controls.
• The article’s core evidence is qualitative, but the pattern is clear. When users can add applications and connectors without central approval, compliance proofs become fragmented and incomplete.
• The practical response is continuous discovery, integration review and privilege governance across the full SaaS estate, including shadow IT and app-level access.

Key terms

• SaaS Sprawl: SaaS sprawl is the uncontrolled spread of software-as-a-service applications across teams and business units. It creates fragmented ownership, duplicated functionality, and weak visibility into who can access what. For IAM and NHI teams, the main risk is not only cost but persistent entitlements that outlive business need.
• Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.
• Integration Governance: Integration governance is the set of controls, policies, and ownership decisions that keep system connections consistent, secure, and manageable. In enterprise signing environments, it helps ensure data flows, access patterns, and application links are coordinated rather than left to ad hoc local decisions.
• Elevated access: Access that gives an identity administrative or otherwise high-impact rights over systems, data, or operational processes. Elevated access is risky because it expands the blast radius of mistakes or misuse, and in seasonal environments it is often granted faster than it is later reviewed.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.