TL;DR: SaaS-first operating models are expanding attack surfaces faster than manual audits and point-in-time tools can track, with Valence Security citing a 58% SaaS security incident rate in the past year as organizations struggle to manage decentralized ownership, shadow SaaS, and NHI sprawl. Continuous discovery and identity-centric remediation now matter more than periodic posture checks.
At a glance
What this is: This is an analysis of how SaaS sprawl, shadow SaaS, and non-human identity growth are making point-in-time security controls inadequate for modern SaaS estates.
Why it matters: It matters because IAM, IGA, and security teams need continuous visibility and lifecycle control across human and non-human SaaS identities, not just periodic reviews.
By the numbers:
- 58% of organisations suffered a SaaS security incident in the past year.
Context
SaaS sprawl creates an identity governance problem because access, ownership, and remediation are spread across business teams rather than controlled through a single operating model. In that environment, security teams can no longer assume they have a complete inventory of identities, privileges, or exposure points across the SaaS estate.
The article’s core point is that point-in-time audits and fragmented SaaS tools miss the pace of daily change. For IAM and NHI programmes, the issue is not just visibility, but the inability to maintain lifecycle control over service accounts, integrations, guest users, and shadow SaaS at the speed the environment changes.
Key questions
Q: What breaks when SaaS security is managed with point-in-time audits?
A: Point-in-time audits miss the rate of change in decentralised SaaS environments. New apps, new integrations, and new privileges can appear after the review window closes, so the resulting control picture is stale almost immediately. That leaves security teams reacting to yesterday’s inventory instead of governing today’s access state.
Q: Why do app-store integrations increase SaaS governance risk?
A: Because every connected app adds another entitlement path that can outlive the original approval. The risk is not only sprawl, but also hidden delegation, orphaned access, and weak offboarding. Without usage telemetry and ownership mapping, security teams cannot tell whether an integration is still justified or simply still active.
Q: How do security teams know if SaaS identity controls are actually working?
A: Look for evidence that lower-assurance identities are fully segregated from sensitive backend paths, not just authenticated differently. A control is working when a breach at one trust tier cannot reach another tenant's data, administrative functions, or session context. If lateral reach remains possible, the control is cosmetic.
Q: Should organisations prioritise remediation or discovery first in SaaS security?
A: They need both, but discovery comes first if they do not know where their access paths are. Once the inventory is accurate, remediation should be tightly automated so stale sharing, excessive privilege, and forgotten integrations are removed quickly. Otherwise, the programme becomes a reporting exercise.
Technical breakdown
Why point-in-time SaaS snapshots fail
A point-in-time snapshot only tells you what the SaaS estate looked like when the scan ran. In a decentralised environment, configuration drift, new integrations, and unsanctioned app adoption can occur daily, which means the attack surface has already changed by the time a report lands. For NHI governance, that creates a structural gap: identities and permissions are being created, reused, or forgotten outside the control plane that security teams can see. The result is a visibility problem that becomes a governance problem when access decisions are based on stale state.
Practical implication: treat SaaS discovery as a continuous control, not an audit activity.
How SaaS identity sprawl creates governance debt
SaaS estates now contain a mix of employees, former employees, contractors, partners, service accounts, integrations, and OAuth tokens. Each identity type has a different lifecycle, but many organisations manage them as if they were all ordinary user accounts. That mismatch creates governance debt: dormant credentials persist, guest users keep excessive privileges, and third-party integrations outlive the business need that justified them. In practice, the security issue is not simply that identities exist, but that ownership and revocation paths are fragmented across business teams and application owners.
Practical implication: inventory every SaaS identity type and assign revocation ownership before access drifts further.
What continuous threat detection adds to SaaS controls
Access management alone does not detect abuse patterns in SaaS. Behavioural signals such as unusual login locations, impossible travel, mass downloads, and privilege escalation provide evidence that an identity is being misused or has gone rogue. These detections are only useful when they are tied into SecOps workflows, because visibility without response still leaves the attack surface open. For identity programmes, this is where governance meets operations: continuous detection closes the gap between entitlement and evidence of misuse.
Practical implication: route SaaS anomaly signals into SIEM and response workflows instead of leaving them in console dashboards.
Threat narrative
Attacker objective: The objective is to exploit unmanaged SaaS identities and permissions to expand access, extract data, and stay outside normal governance and detection workflows.
- Entry occurs through unsanctioned SaaS adoption, third-party integrations, or dormant identities that security teams do not continuously track.
- Credential or privilege exposure then builds through guest users, service accounts, and OAuth tokens that retain more access than their business role justifies.
- Escalation follows when attackers or abusive insiders use those permissions for mass downloads, privilege expansion, or lateral movement across connected SaaS systems.
- Impact is data exposure, weak compliance posture, and a larger attack surface that security teams cannot reliably reduce with periodic review alone.
Breaches seen in the wild
- SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Continuous discovery is now the baseline control for SaaS governance: point-in-time review models cannot keep pace with decentralised app adoption, shadow SaaS, and daily configuration drift. When ownership is spread across business units, the security team is no longer dealing with a finite inventory but with a moving target. The practical conclusion is that continuous discovery has to sit ahead of any remediation or review workflow.
SaaS identity sprawl is really lifecycle debt: the article’s service accounts, integrations, guest users, and OAuth tokens are not separate edge cases, they are one governance problem expressed through different identity types. The failure mode is that revocation, ownership, and privilege review are not designed to travel across application silos. Practitioners need to treat SaaS identity lifecycle as an entitlement problem, not just an application-admin problem.
Shadow SaaS changes the trust boundary of NHI governance: unmanaged applications create unmanaged identities, and unmanaged identities create unmanaged access paths. That is why a SaaS security programme cannot stop at sanctioned applications or traditional user reviews. Security teams should assume that any SaaS estate with fragmented ownership will also have fragmented trust, and they should govern accordingly.
Ephemeral application ownership needs a named control concept: call it SaaS governance drift. The environment changes faster than the review cadence, so organisations build control logic around yesterday’s ownership and yesterday’s privileges. The practitioner implication is clear: if the control plane does not move with the application lifecycle, it cannot meaningfully reduce SaaS risk.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: NHI Security Platform Buyer's Guide
What this signals
SaaS governance drift: when application ownership is decentralised, the identity programme has to govern a continuously changing control surface rather than a static application list. That shifts the operating model from periodic review to continuous discovery and lifecycle enforcement.
Security teams should expect the greatest exposure in the seams between sanctioned SaaS, shadow SaaS, and unmanaged non-human identities. The practical response is to align SaaS governance with identity lifecycle management so revocation, ownership, and monitoring happen across the same control plane.
For practitioners
- Build continuous SaaS discovery Track sanctioned and unsanctioned applications together, and keep discovery running often enough to catch daily change rather than monthly drift.
- Inventory all SaaS identity types Map employees, former employees, contractors, partners, service accounts, integrations, and OAuth tokens into one governed ownership model.
- Remove dormant and excessive access Prioritise dormant accounts, guest users with excessive privileges, and inactive identities that still retain file-sharing or application access.
Key takeaways
- SaaS sprawl turns governance into a continuous control problem because access and ownership change faster than manual audits can track.
- The main evidence is not theoretical drift but widespread incident experience, which shows the control gap is already operational.
- Organisations need discovery, lifecycle ownership, and behavioural monitoring to reduce SaaS exposure instead of merely describing it.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Dormant SaaS identities and forgotten integrations are central to the article's governance gap. |
| NHI-05 — Overprivileged NHI | The article highlights guest users, integrations, and service accounts with excessive privileges. | |
| NHI-07 — Long-Lived Secrets | OAuth tokens and service accounts can persist far beyond their intended lifecycle in SaaS estates. | |
| Recommendation — Track and remove SaaS identities that no longer have an active business owner or purpose. Review SaaS entitlements for excess access and reduce privileges to the minimum required. Shorten the lifetime of SaaS credentials and revoke tokens when their owning use case ends. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about access scope, ownership, and entitlement governance across SaaS. |
| Recommendation — Apply PR.AA-05 to align SaaS entitlements with current business ownership and need. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Unmanaged SaaS identities and integrations create routes for credential abuse and movement across connected apps. |
| Recommendation — Map SaaS identity abuse to TA0006 and TA0008 to prioritise detection and containment. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | SaaS sprawl and identity sprawl are cloud identity governance issues in the CCM IAM domain. |
| Recommendation — Use CCM IAM to enforce ownership, access review, and deprovisioning across SaaS identities. | ||
Key terms
- SaaS Governance Gap: The difference between who can operate a SaaS application and who can see, approve, and enforce its security settings. In practice, it appears when local administrators make identity and sharing decisions faster than central teams can review or correct them.
- Shadow SaaS: Shadow SaaS is the set of unauthorised or unreviewed software-as-a-service tools used outside central security governance. These applications often bypass normal identity controls, making them difficult to inventory, monitor, and harden against credential-based abuse.
- SaaS Identity Risk: SaaS identity risk is the chance that identities used to access software delivered over the internet are misused, overprivileged, or poorly governed. It includes human users, service accounts, API tokens, and connected apps. Technical risk arises when authentication, authorization, lifecycle control, or monitoring fails across tenant, application, and integration boundaries.
- Continuous discovery: Continuous discovery is the ongoing process of detecting identities as they appear, change, or disappear across environments. For AI agents and other NHIs, it prevents inventory drift and keeps ownership, privilege, and lifecycle controls aligned with the live environment.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on May 28, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org