SaaS visibility gaps expose shadow IT, spend waste and access risk

At a glance

What this is: This analysis says SaaS management breaks down when discovery, source-of-truth tracing and deprovisioning data are incomplete or stale, leaving organisations blind to shadow IT, spend waste and residual access.

Why it matters: Identity, IGA and security teams need accurate SaaS inventory and revocation data because governance decisions fail when the system of record cannot reliably prove what exists, who has access, and what should be removed.

Context

SaaS visibility is only useful when the inventory is current, attributable and complete. If the platform cannot discover all applications, tie each record back to a source of truth, and keep access data fresh, then procurement, security and identity teams are making governance decisions on partial evidence.

The identity implication is straightforward: SaaS management is not just software administration, it is lifecycle control over human access to business applications. When discovery misses apps or deprovisioning misses accounts, shadow IT, excess spend and residual access become the same governance failure expressed in different ways.

Key questions

Q: What breaks when SaaS discovery is incomplete?

A: Incomplete discovery leaves shadow apps, duplicate subscriptions, and employee-purchased tools outside the control model. That means invoices cannot be matched cleanly, renewal decisions are based on partial data, and ownership remains ambiguous. In practice, the organisation pays for services it cannot reliably govern or retire.

Q: Why does stale SaaS data create access governance risk?

A: Because access, usage, and renewal decisions depend on the current state, not last week’s state. When data is stale, teams can certify access that no longer exists, miss unused licences, or overlook shadow applications. The result is weak control over both entitlement risk and software spend.

Q: How should security teams govern shadow IT in SaaS environments?

A: Security teams should govern shadow IT by treating it as unmanaged access, not just unsanctioned software. Start with continuous discovery, then map each app to owners, data types, delegated scopes, and revocation paths. The control goal is to reduce hidden access paths before they become business-critical dependencies.

Q: What should teams get wrong about offboarding in SaaS environments?

A: They often assume disabling the primary account is enough. In reality, offboarding must also remove app-specific accounts, revoke OAuth tokens, and confirm that shadow IT services do not retain access. If the app estate is only partially known, offboarding is partial by definition and leaves residual access behind.

Technical breakdown

Why SaaS discovery methods determine governance accuracy

SaaS management platforms depend on discovery coverage because they can only govern what they can see. Zluri describes discovery through SSO, finance systems, API integrations, optional desktop agents and browser extensions, each of which captures a different slice of the SaaS estate. That matters because no single source sees employee-purchased tools, authorised logins, licence usage and web-based app activity equally well. The technical problem is not merely coverage, but reconciliation across sources so the inventory remains usable as a governance record.

Practical implication: validate that discovery sources cover both sanctioned and unsanctioned app use before trusting the inventory for access or spend decisions.

Why source-of-truth tracing matters for SaaS and access decisions

A governance record is only credible when each data point can be traced back to where it came from. Zluri emphasises source-of-truth tracing for SaaS usage, user data and cost data, including the ability to compare contract values with actual spend. Technically, this reduces ambiguity between detected usage, licensed entitlement and financial truth. Without that traceability, organisations cannot tell whether a record represents an authoritative system, a sync artefact or a stale approximation.

Practical implication: require source attribution for app, user and spend records so reviewers can challenge anomalies instead of acting on opaque summaries.

How deprovisioning gaps turn incomplete inventory into access risk

When the inventory is incomplete, deprovisioning becomes probabilistic rather than deterministic. The article’s example of discovering only 40 of 50 apps shows the core failure: access revocation is only as complete as the app map behind it. In SaaS environments, residual access can survive because the forgotten application never enters the offboarding workflow. That creates a compound problem where the control appears to have succeeded while a portion of the estate remains untouched.

Practical implication: tie offboarding to application discovery completeness, not just account closure, so hidden apps do not retain active access after departure.

Threat narrative

Attacker objective: The practical objective is to keep unauthorised or residual access available long enough to expose data, inflate spend or widen the organisation’s attack surface.

1. Entry occurs when employees adopt unsanctioned SaaS tools or purchase apps outside IT visibility, creating shadow IT that bypasses normal governance intake.
2. Credential and access exposure follows when the platform inventory misses apps or users, leaving active accounts, shared data and app permissions outside deprovisioning scope.
3. Impact emerges as unused licences auto-renew, hidden charges persist, and former employees or other unauthorised users retain access to business data.

Breaches seen in the wild

• SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

SaaS visibility is a governance control, not a reporting feature: The article makes clear that incomplete discovery changes the quality of every downstream identity decision. If the system of record cannot see all applications and users, then offboarding, licence rationalisation and risk assessment all become partial exercises. The practitioner conclusion is that SaaS management accuracy must be treated as an identity control plane requirement, not a dashboard metric.

Source-of-truth tracing is what separates evidence from estimates: Zluri’s emphasis on tracing data back to its original source reflects a broader governance truth. A record without provenance cannot support audit, dispute resolution or access review with any confidence. Practitioners should treat opaque SaaS inventories as opinion, not authority, until each object can be traced to an underlying system of record.

Residual access is the hidden failure mode behind incomplete SaaS inventory: This article shows that offboarding is only as strong as application discovery. The missed application, not the revoked one, is what preserves access after departure. That is why lifecycle governance across SaaS must be measured by closure completeness, not by the number of accounts successfully removed.

Spend waste and access risk are the same visibility problem expressed differently: Unused licences, hidden charges and shadow IT are often discussed as separate optimisation issues, but they share one root cause: the platform does not know enough about the environment to govern it. The named concept here is visibility debt, meaning the accumulated governance loss created when discovery, attribution and refresh cycles lag the real SaaS estate. Practitioners should treat spend and security as one control problem when the underlying data model is incomplete.

Accurate SaaS governance depends on lifecycle logic that extends beyond sanctioned apps: The article’s examples show why offboarding cannot be limited to the applications already on the approved list. Governance has to account for the applications people actually use, including those bought outside procurement and those discovered late. The practitioner implication is clear: lifecycle controls must begin with complete discovery or they will never close the full access surface.

From our research library:

• The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.

What this signals

Visibility debt: When discovery, provenance and refresh cycles lag the actual SaaS estate, governance teams inherit a control gap that looks like routine administration but behaves like access risk. The programme signal is that inventory quality now determines whether offboarding and spend controls are credible.

SaaS governance teams should expect more of their control failures to start with incomplete discovery rather than overt compromise. The practical shift is to evaluate coverage, source attribution and revocation completeness as one operating model, not three separate tasks.

For practitioners

• Audit SaaS discovery coverage across all intake paths Compare SSO, finance, API and endpoint-based discovery against the actual application estate to identify blind spots in sanctioned and unsanctioned app use.
• Tie offboarding to app inventory completeness Require the offboarding workflow to confirm every discovered application has been checked for active accounts before closure is declared complete.
• Trace spend records back to the source system Verify that contract, usage and payment records are all attributable so hidden charges and false renewals can be challenged with evidence.
• Review shadow IT as an identity issue Treat employee-purchased apps as access governance events because each unmanaged app may carry data, permissions and retention risk.
• Reconcile licence counts before renewal Use actual usage data to reduce auto-renewal of unused licences and to rightsize tiers before procurement commits to a new term.

Key takeaways

• SaaS management fails when the inventory is incomplete or stale, because governance decisions then rest on partial evidence rather than a trustworthy system of record.
• The article ties missing discovery to three operational outcomes: shadow IT, wasted licence spend and lingering access after offboarding.
• The control lesson is to measure SaaS lifecycle governance by coverage, provenance and closure completeness, not by how polished the dashboard looks.

Key terms

• SaaS Discovery: SaaS discovery is the process of identifying all sanctioned and unsanctioned software-as-a-service applications in use across the organisation. It matters because cloud assurance increasingly depends on seeing where apps share data, what permissions they hold, and which identities can reach them.
• Source of truth: A source of truth is the authoritative store that holds the current, trusted version of project state or operational knowledge. For AI workflows, it should be a controlled system such as a repository, task platform, or note vault that agents can read and update through governed access paths.
• Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.
• Deprovisioning: Deprovisioning is the removal of access when a user changes roles or leaves an organisation. For security teams, it is the point where stale accounts, tokens, and permissions should disappear. Weak deprovisioning leaves residual access that can outlive the business need that created it.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.