SaaS visibility gaps turn identity governance into a cost and risk issue

At a glance

What this is: This is a case study showing how Quantum Brilliance reduced SaaS waste and improved visibility by moving from spreadsheets to centralized discovery, license control, offboarding, and audit support.

Why it matters: It matters because SaaS sprawl is not only a cost-management issue, it creates unresolved access paths that IAM, IGA, and security teams have to govern across distributed environments.

By the numbers:

• Quantum Brilliance saw 30–50% SaaS cost reduction through license optimization and eliminating unused subscriptions.

Context

SaaS visibility is a governance problem as much as a financial one. When application ownership, access, and offboarding are tracked in spreadsheets, teams lose the ability to see where accounts exist, who still has access, and which subscriptions are active without oversight.

Josys uses Quantum Brilliance as an example of what happens when growth outruns control. The article ties scattered app ownership, manual offboarding, and decentralised procurement to both wasted spend and lingering access risk, with ISO 27001 compliance as part of the operating context.

For IAM and IGA teams, the important issue is that SaaS inventory, access review, and leaver management sit on the same control plane. If any one of those is weak, the organisation pays for dormant subscriptions while leaving avoidable access paths in place.

Key questions

Q: What fails when SaaS visibility depends on spreadsheets?

A: Spreadsheet-led SaaS management fails because it cannot continuously reconcile app ownership, active accounts, usage, and offboarding state. The result is shadow IT, stale access, and decisions made without a trustworthy system of record. For IAM and IGA teams, that means visibility has to be operational, not periodic.

Q: Why do unused SaaS licences create identity risk as well as cost waste?

A: Unused licences often indicate that apps are still licensed after the people or teams that justified them have changed. That usually means access review, account removal, and contract ownership are not aligned. The result is unnecessary spend plus a larger surface for stale access and administrative confusion.

Q: What are the signs that employee offboarding is failing in practice?

A: Common warning signs include still-active sessions after termination, lingering logins on SaaS platforms, missed shared credentials, and unexpected file downloads or configuration changes. Another red flag is incomplete device recovery or gaps in the audit trail. If alerts show login attempts from deactivated accounts, the offboarding process likely missed a revocation step or took too long.

Q: How should security teams prove SaaS governance for ISO 27001 audits?

A: They should be able to show a current SaaS inventory, access review evidence, revocation timestamps, and reports that tie each control to a specific application owner. Auditors are looking for proof that access is reviewed and removed consistently, not just that a policy exists. If the evidence lives in multiple spreadsheets, the control will be difficult to defend.

Technical breakdown

Why spreadsheet-based SaaS administration fails at scale

Spreadsheet administration breaks because it is not a control system. It can list applications, but it cannot continuously reconcile ownership, usage, entitlement drift, or offboarding state across multiple business units and geographies. In fast-growing SaaS estates, that creates a gap between what the organisation thinks it owns and what is actually deployed. The result is shadow IT, duplicate purchasing, and accounts that persist after employees or contractors leave. From an identity governance perspective, the failure is not just incomplete data. It is the absence of a reliable system of record for application access and lifecycle status.

Practical implication: centralise SaaS inventory and ownership in a governed system rather than relying on static spreadsheets.

How license waste becomes an identity governance issue

Unused seats are not just procurement waste. They are often a signal that account lifecycle control is weak, because inactive licenses frequently coexist with stale accounts, unmanaged admins, or orphaned access paths. When procurement is decentralised, teams can renew applications without validating whether the attached identities still map to current business need. That is why cost optimisation and access governance converge in SaaS estates. The same control evidence that proves a subscription is unused also helps prove that access should be removed. In practice, this makes spend reporting a governance input, not only a finance report.

Practical implication: pair license reviews with entitlement reviews so idle spend and dormant access are removed together.

Why automated offboarding closes a recurring SaaS access gap

Offboarding is where SaaS sprawl becomes an identity security exposure. If app access depends on manual follow-up, every departure introduces a delay window in which former employees or contractors may retain access. Automated notifications shorten that window by triggering the right stakeholders immediately and forcing revocation to happen through a repeatable process. This matters because the risk is not theoretical. In distributed organisations, even small lag times accumulate into persistent orphaned accounts across many apps. Automated offboarding is therefore a lifecycle control for SaaS access, not just an HR convenience.

Practical implication: connect leaver events to SaaS revocation workflows so account removal happens as part of the departure process.

Threat narrative

Attacker objective: The practical objective in this pattern is to retain or exploit ungoverned SaaS access long enough to create avoidable exposure, audit weakness, or account misuse.

1. Entry occurs through decentralised SaaS purchasing and unmanaged app onboarding, which creates shadow IT before security or IAM teams can account for the application.
2. Credential and access persistence follow when offboarding is manual, leaving former users or contractors with valid SaaS access after they have left.
3. Impact shows up as lingering exposure, wasted license spend, and weaker audit readiness because the organisation cannot prove who should still have access.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

SaaS visibility debt is a governance failure, not an inventory inconvenience. When organisations cannot see their application estate, they cannot reliably govern access, spending, or offboarding across it. The control gap is not just missing data, but missing decision authority over what is active and who still depends on it. The implication is that SaaS discovery has to be treated as identity governance infrastructure, not a back-office reporting task.

License optimisation and access removal are the same operational problem. Unused seats often reveal the same lifecycle weakness that leaves stale accounts behind. If procurement, access review, and offboarding are not aligned, organisations can keep paying for software they no longer use while preserving access they no longer need. Practitioners should treat SaaS spend evidence as a signal for entitlement cleanup, not as a finance-only metric.

Offboarding latency is the hidden control boundary in distributed SaaS environments. The longer removal depends on manual follow-up, the more likely former users, contractors, or admins will remain present in applications after departure. That gap becomes larger when teams operate across borders and business units with inconsistent ownership. Security teams should read every manual offboarding step as a residual access risk.

ISO 27001 pressure makes SaaS governance an evidence problem. The article correctly ties visibility and compliance together because audit readiness depends on showing who has access, who reviewed it, and how quickly access was removed. Without that evidence trail, organisations are left with process claims rather than control proof. The practitioner takeaway is simple: if you cannot evidence SaaS lifecycle control, you do not yet have it.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: NHI Lifecycle Management Guide

What this signals

Identity governance for SaaS now starts with discovery. Once application sprawl exceeds manual tracking, access reviews and offboarding become downstream effects of inventory quality. Teams should treat SaaS discovery as the prerequisite for reliable lifecycle control, not as a separate operations project.

Visibility debt compounds across finance, IAM, and audit. Josys' example shows that the same blind spot can produce unused spend, stale access, and weak evidence for compliance reviews. The practical response is to align procurement, entitlement review, and leaver handling inside one operating model.

Shadow IT is now an access-control problem. When unapproved apps emerge outside central oversight, the issue is not only policy violation but ungoverned identities attached to those apps. That makes SaaS inventory part of the identity perimeter, not merely an asset register.

For practitioners

• Centralise SaaS inventory and ownership Create one governed view of all SaaS apps, owners, and access paths so decentralised procurement does not outrun control.
• Link license reviews to access reviews Use unused seats and inactive subscriptions as triggers for entitlement review, admin validation, and removal of stale accounts.
• Automate leaver-triggered revocation Connect offboarding events to app-specific notifications and revocation workflows so departures do not rely on manual follow-up.
• Build audit evidence from the same control plane Retain access review records, revocation timestamps, and compliance reports in one place so ISO 27001 evidence is available when needed.

Key takeaways

• SaaS sprawl becomes an identity governance problem when teams lose track of ownership, access, and offboarding across a growing application estate.
• The article ties visibility improvements to both cost reduction and lower residual access risk, which is why finance and security outcomes move together.
• The practical control lesson is to manage SaaS discovery, entitlement review, and leaver revocation as one lifecycle process.

Key terms

• SaaS Visibility: SaaS visibility is the ability to identify which software services, tenants, and accounts exist in an environment and who controls them. In identity governance, it is the prerequisite for review, offboarding, and cost control because hidden applications cannot be certified or revoked reliably.
• Offboarding Latency: Offboarding latency is the delay between removing an identity's access entitlement and the actual disappearance of that access from systems. For NHIs and privileged access paths, long latency creates residual exposure, especially when multiple platforms or extra components must be cleaned up separately.
• Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.
• License Optimisation: License optimisation is the process of matching software entitlements to actual use so organisations do not pay for access they no longer need. In identity terms, it is a governance function because entitlement reduction often requires review, downgrade, or deprovisioning decisions.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.