TL;DR: Unchecked software buying creates shadow IT, license waste, and compliance exposure, according to Zluri’s guide to software asset management best practices. The real issue is governance drift, where procurement, usage tracking, and audit discipline fall out of sync with actual application sprawl.
At a glance
What this is: This is a software asset management guide that argues unmanaged software purchasing and weak tracking create shadow IT, waste, and compliance risk.
Why it matters: It matters because IAM, IGA, and procurement teams need a governed view of software use to stop unapproved applications from becoming security and audit liabilities.
Context
Software asset management is the discipline of inventorying, governing, and renewing software in line with policy, licences, and actual use. In this article, Zluri uses that lens to show how ad-hoc purchasing and weak oversight create shadow IT, wasted spend, and compliance exposure.
The identity governance connection is practical rather than abstract: unapproved software often arrives with its own users, permissions, and access paths outside normal review cycles. When procurement, IT, and security do not share the same inventory, the organisation loses the ability to control what is installed, who is using it, and whether it still belongs in the environment.
Key questions
Q: How should teams stop shadow IT in software asset management?
A: Teams should combine software discovery, procurement approval, and usage monitoring into one operating model. Shadow IT persists when these signals live in separate systems. The practical fix is to make unapproved applications visible fast enough that ownership, access, and renewal decisions can be made from the same inventory.
Q: Why do unused software licences create security and governance risk?
A: Unused licences are not only a cost problem. They signal weak inventory discipline, which often means dormant access, stale integrations, and unclear ownership are present too. When governance cannot prove who is using an application and why, renewal and access decisions become guesswork instead of control.
Q: What breaks when software usage is not audited regularly?
A: Without regular audits, organisations cannot tell whether installed software still matches approved contracts, active users, and policy conditions. That means expired licences, unapproved tools, and duplicate subscriptions can persist unnoticed. Audit failure is usually a visibility failure first, and a compliance failure second.
Q: How do procurement and IT teams govern software renewals more effectively?
A: They need a renewal decision process that combines spend, usage, and business ownership. If renewals are handled only as finance events, underused software keeps getting extended and shadow IT remains invisible. Governance works best when every renewal has an accountable owner and an evidence-backed decision.
Technical breakdown
Why software sprawl becomes a governance problem
Software sprawl is not just a cost issue. When teams buy and use applications outside central oversight, the inventory that supports licensing, access review, and compliance checks stops reflecting reality. That creates a governance gap between approved software and actual software in use. Shadow IT widens the gap further because the organisation cannot reliably see the full application set, the users attached to it, or the licences tied to it. In practice, the failure is not only poor control but poor visibility into the software estate itself.
Practical implication: build a single inventory that joins discovery, procurement, and usage data before running audits or renewal decisions.
How licence tracking breaks when usage is not measured continuously
Licence management depends on knowing what has been purchased, what is active, and what is unused. If usage data is stale or fragmented across tools, organisations overbuy to avoid shortages or keep paying for dormant entitlements. The article’s core point is that usage monitoring has to be tied to actual consumption, not just contract records. That is especially important when a vendor environment includes renewals, true-up costs, and multiple ownership points across IT, procurement, and finance. Without measurement, licence optimisation becomes guesswork.
Practical implication: baseline software consumption regularly and use that dataset to drive renewal, reallocation, and retirement decisions.
Why regular audits matter for software asset management
Audits are the control that turns inventory into action. In a software estate with shadow IT, expired licences, and unapproved installations, regular audits expose where policy and practice have diverged. They also surface whether software use still aligns with licence terms, regulatory obligations, and internal approval paths. The article treats audits as more than compliance paperwork. They are the mechanism that shows whether the software asset management programme is actually governing the estate or merely recording purchases after the fact.
Practical implication: schedule recurring software audits that test installed applications, licence assignment, and approval status against policy.
NHI Mgmt Group analysis
Software asset management fails first as a visibility problem, not a budgeting problem. Once teams cannot see what has been bought, installed, and actively used, every downstream control becomes reactive. That is why shadow IT is not a side issue but the point where governance and reality separate. Practitioners should treat discovery and inventory as the foundation of software control, not a reporting add-on.
Shadow IT is a governance drift signal. It shows that procurement, IT, and security are no longer operating from the same source of truth. The result is duplicated applications, unauthorised tooling, and renewal decisions made against incomplete data. The discipline required here is less about policy wording and more about keeping the operating picture current enough to govern.
Licence waste and compliance exposure are the same failure seen from different angles. Overspend happens when unused software remains purchased, while compliance risk emerges when software use no longer matches licence terms or approval conditions. A mature SAM programme has to bind spend control to access control, because the software estate is also part of the identity surface.
Governance over software assets is now an IAM-adjacent control plane. Software inventories influence who can access which tools, which tools remain sanctioned, and which applications sit outside normal lifecycle review. That makes SAM relevant to IGA, procurement, and security operations at once. Practitioners should align software governance with access governance, not run them as separate programmes.
Cost control is not the end state of software asset management. The real goal is controlled software sprawl with evidence that every application still has a business owner, a usage pattern, and an approved place in the estate. That is the difference between portfolio management and governed identity infrastructure.
From our research library:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
- Read next: IGA Buyer's Guide
What this signals
Software asset management is increasingly an identity governance issue. When unapproved applications proliferate, the organisation is not only losing spend control but also losing control over where identities, permissions, and access decisions are being created. The operational answer is to govern software intake and software access together, because the application estate now defines part of the identity surface.
Governance drift is the named failure mode here. Procurement may approve one picture of the environment, while IT and security operate against another. That mismatch is what allows shadow IT, duplicate tooling, and dormant licences to accumulate. Practitioners should look for any process where renewal, access, and ownership decisions no longer use the same inventory.
For practitioners
- Define a software asset management policy Set ownership for procurement, IT, legal, and security so software intake, approval, renewal, and retirement follow one process rather than ad hoc buying.
- Centralize software inventory data Join discovery, licence records, contracts, and usage data into one inventory so the team can see installed applications and active entitlements together.
- Track usage against entitlements Review underused, duplicated, and unapproved applications on a regular cadence so licences can be reassigned or removed before renewals lock in waste.
- Run recurring software audits Compare installed software and active users to policy and licence terms, then close gaps where applications no longer belong in the environment.
- Link procurement to renewal decisions Use business need, spend data, and application activity to decide whether to maintain, rightsize, or retire each subscription at renewal.
Key takeaways
- Software asset management breaks down when organisations cannot keep procurement, usage, and approval data aligned with the live software estate.
- The article links weak oversight to shadow IT, wasted licences, and compliance exposure, which are all symptoms of the same governance drift.
- The most effective response is a governed inventory, recurring audits, and renewal decisions based on actual consumption rather than assumptions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centres on controlling software access and entitlement drift across the estate. |
| Recommendation — Map software inventories to PR.AA-05 and remove unsanctioned access paths from shadow IT apps. | ||
| CIS Controls v8 | CIS-5 — Account Management | Unmanaged software usage creates account and access sprawl that account management must govern. |
| Recommendation — Use CIS-5 to align software ownership, user access, and offboarding across approved applications. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Shadow IT often expands access beyond what least privilege would permit. |
| Recommendation — Apply AC-6 to reduce unnecessary access in software platforms that lack central governance. | ||
| MITRE ATT&CK | TA0007;TA0008 — Discovery; Lateral Movement | Untracked software broadens discovery and movement opportunities inside the environment. |
| Recommendation — Map shadow IT exposure to TA0007 and TA0008 to prioritise app discovery and access control. | ||
Key terms
- Software Asset Management: Software asset management is the process of tracking, optimising, and governing software usage, licences, and contracts across an organisation. In modern SaaS environments, it increasingly depends on identity data because software value and software risk are both defined by who or what can use the application.
- Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.
- License Entitlement: A license entitlement is the bundle of application capabilities a user is allowed to consume. In identity governance, it should be treated like access rather than a commercial line item, because over-allocation and stale assignment can create both cost waste and security exposure.
- Software Sprawl: Software sprawl is the accumulation of overlapping, redundant, or underused applications across an organisation. It becomes a governance problem when the volume of apps outpaces the ability to assign ownership, review access, and retire software cleanly.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on June 11, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org