SAM and ITSM together close the gap between unused seats and access removal

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Serval's blog post: Software asset management finds unused licenses, but reclaiming value depends on ITSM-linked access removal and lifecycle execution.

Why it matters: This matters because IAM and ITSM teams need a closed loop between entitlement visibility, access revocation, and renewal decisions when software seats outlive the people who use them.

Context

Software asset management answers a simple question: what software does the organisation own or lease, and where is it being used? The harder question is what to do when a seat goes unused, especially when access lives across separate admin consoles and ownership is spread across teams.

The governance gap is lifecycle execution. Discovery can tell you a seat is idle, but it does not itself remove access, update the entitlement record, or make the seat available for reassignment. That is why software licensing often becomes an identity and service-management problem as much as a procurement one.

Asset management policy helps define ownership, criticality, and disposal, but the operational handoff still matters when the goal is to reclaim spend and prevent stale access from following employees across role changes.

Key questions

Q: How do teams reclaim software license spend after offboarding?

A: Teams reclaim software licence spend by tying offboarding to entitlement record closure, then removing the user’s accounts, licences, and any shared service entitlements that remain assigned. The control is a joiner-mover-leaver workflow with access reviews, automated deprovisioning, and licence reconciliation against HR and identity data so dormant subscriptions are released back to the pool.

Q: Why does unused software access keep costing money after a project ends?

A: Unused software access keeps costing money because licences, seats, or subscriptions remain assigned after the user stops needing them, so the organisation keeps paying for provisioned entitlements. Common failure modes are missed deprovisioning, orphaned accounts, and shared accounts that are never reallocated, which leaves consumption and compliance records out of sync with actual use.

Q: How should teams handle temporary access for projects and coverage?

A: Treat temporary access as an expiring entitlement, not as a special favour that will be cleaned up later. Set a duration at approval time, route approval through the right owner and ensure the grant is automatically removed when the task, leave or coverage period ends. If expiry is not part of the grant, the access will linger.

Technical breakdown

Why unused software seats persist after offboarding

Unused seats persist because software ownership, login activity, and procurement records rarely move in one synchronised workflow. A SAM tool can identify that a license is no longer active or that usage has fallen below a threshold, but it cannot by itself enforce access revocation across every application. In practice, the unresolved seat sits between entitlement accounting and access administration. That is why seat recovery depends on the connection between inventory, identity, and ticketing, not on discovery alone.

Practical implication: Treat seat reclamation as a workflow that must end with access removal, not as a reporting exercise.

How ITSM turns license findings into access actions

ITSM provides the operational layer that closes the loop from finding to change. When a help desk request, offboarding task, or automated reclamation event creates a ticket, the platform can route revocation, record the result, and preserve an audit trail. That matters because the value of the discovery signal is lost if the organisation cannot prove what was removed, when it was removed, and whether the seat can be reassigned under the contract terms. ITSM is therefore the execution system for SAM findings.

Practical implication: Link SAM events to ticketed workflows so revocation and reassignment become auditable service actions.

Why just-in-time access changes the reclamation model

Just-in-time access changes the licence problem by making duration explicit at request time. Instead of waiting for inactivity to trigger recovery later, the access grant can expire when the work ends. That reduces the chance that a temporary project seat becomes a forgotten renewal cost. It also creates cleaner evidence for finance and procurement because the expected end date is already part of the original request. JIT does not replace entitlement control, but it reduces the number of seats that depend on after-the-fact recovery. Read Admin panels and super admin accounts.

Practical implication: Use time-bounded access where the business case is temporary so expiry is built into the request from the start.

Threat narrative

Attacker objective: The objective is to preserve access and entitlement waste long enough that the organisation keeps paying for software it no longer needs.

1. Entry occurs when access remains assigned after an employee leaves, changes roles, or stops using a tool, leaving a paid seat active beyond its business need.
2. Escalation follows when that stale access remains recoverable or reusable through delayed offboarding, missed admin-console updates, or an absent reclamation workflow.
3. Impact is financial and operational: the organisation keeps paying for unused seats and may carry outdated permissions into later lifecycle changes.

Breaches seen in the wild

• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Seat reclamation is a lifecycle control, not a procurement clean-up task. Discovery can surface unused licences, but the governance problem is whether access is actually removed and the entitlement is made reusable. Organisations that treat software reclamation as a finance-only issue leave the identity and ticketing handoff unresolved, which is where waste persists. The practical conclusion is that the control boundary sits at lifecycle execution, not at inventory reporting.

Software asset management and ITSM solve different halves of the same problem. SAM identifies entitlement mismatch, while ITSM executes the change that turns a finding into a recovered seat. Serval's model reflects a wider pattern in identity operations: visibility without action produces evidence, not control. Practitioners should align ownership so one system proves the need and the other enforces the outcome.

Licensing governance now depends on the quality of connected records. If identity, procurement, and application data do not agree, the help desk cannot tell whether a seat is still assigned, reusable, or contractually locked. That creates a governance blind spot where teams may buy more before reclaiming what they already have. The practitioner takeaway is to treat record alignment as part of access governance, not as a back-office data hygiene task.

JIT access reduces the size of the recovery problem, but it does not eliminate the need for recovery. Time-bounded access is useful because it defines an end state up front, yet many software environments still rely on manual follow-through for offboarding and role changes. That means the core discipline is still lifecycle closure. Teams should assume every temporary seat will eventually need a verified end event, even when the original request looked well controlled.

From our research library:

• Around 59% of companies report experiencing a data breach related to poorly managed offboarding processes.
• Read next: Asset Management Policy Template

What this signals

Lifecycle closure is where software cost control succeeds or fails. Teams that can identify unused licences but cannot close the access loop are left with a reporting problem disguised as asset management. The governance signal is clear: entitlement intelligence has to be paired with revocation authority, or the seat remains a cost centre even after the user is gone.

Seat recovery is becoming a control objective in its own right. The organisations that get value from SAM are the ones that can move from discovery to verified removal without relying on ad hoc manual follow-up. That means linking entitlement data, access requests, and offboarding workflows into one operational path instead of treating them as separate programmes.

For practitioners

• Tie offboarding to entitlement removal Make every employee exit or role change create a revocation step for application seats, with confirmation recorded before the ticket can close.
• Connect SAM findings to service workflows Route unused-seat findings into ITSM so the help desk can assign ownership, track disposition, and preserve an audit trail for each recovery action.
• Set expiry on temporary access requests Use time-bounded access for project-based software so the seat expires with the work instead of waiting for inactivity detection later.
• Verify seat reuse against contract terms Check whether the software agreement allows mid-term seat reassignment or only renewal-time reductions before you count a reclaimed license as savings.

Key takeaways

• Software licence waste persists when discovery is not connected to access removal and seat reassignment.
• The operational weakness is lifecycle execution, not the ability to spot an unused entitlement.
• Teams get the best results when SAM findings flow into ITSM workflows that can revoke access and record the change.

Related NHI Mgmt Group resources: Asset Management Policy Template · How to audit Slack apps, bots and tokens · Enterprise-Managed Authorisation for AI Agents

Key terms

• Software Asset Management: Software asset management is the process of tracking, optimising, and governing software usage, licences, and contracts across an organisation. In modern SaaS environments, it increasingly depends on identity data because software value and software risk are both defined by who or what can use the application.
• It Service Management: IT service management is the set of processes used to request, approve, deliver, and support internal technology services. In identity programmes, it often becomes the operational layer where access requests, approvals, and exception handling are recorded and enforced.
• Just-in-Time (JIT) Access: Just-in-Time (JIT) Access grants permissions only when needed and removes them after use. In IAM and PAM, it reduces standing privilege by issuing time-bound access based on approval, context, or policy, limiting exposure for humans, service accounts, and non-human identities while improving auditability and control.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.