Software asset management shows why visibility, not inventory, is the gap

At a glance

What this is: This is a guide to software asset management that argues the core problem is not just inventory, but visibility into use, entitlement, renewal, and disposal.

Why it matters: For IAM and governance teams, the lesson is that software control fails when the organisation cannot connect what exists, what is used, and what is still licensed.

Context

Software asset management is the discipline of governing software across procurement, deployment, usage, renewal, and retirement. In practice, the article argues that the hardest part is not counting applications but maintaining reliable visibility across decentralised buying, shadow IT, and entitlement drift.

That distinction matters for identity and access governance because software access, licensing, and usage are all tied to who can acquire tools, who keeps using them, and when those rights expire. The article’s core point is that inventory without usage context does not create control, and control without lifecycle tracking does not create compliance.

Key questions

Q: How should teams govern software that users can buy outside IT?

A: Treat it as a lifecycle governance problem, not just procurement sprawl. Put discovery, intake approval, entitlement matching, and renewal ownership into one process so software does not enter the estate without a responsible owner and a retirement path.

Q: Why does software inventory alone fail to control SaaS risk?

A: Because inventory only tells you what exists, not whether it is used, entitled, or renewing correctly. SaaS risk appears when visibility into usage and licence status is missing, which is why the control must connect discovery to entitlement and lifecycle tracking.

Q: What breaks when organisations do not track named-user software licences carefully?

A: Named-user licensing fails when assignment no longer matches actual use. That creates unused seats, renewal surprises, and weak accountability for who is entitled to use the software. It also makes audits harder because the organisation cannot prove that access and billing stayed aligned with current users.

Q: Should organisations compare software asset management with access governance?

A: Yes, because both disciplines are about matching rights to actual use over time. In SAM, the right is a software entitlement; in IAM, it is access permission. The common problem is stale entitlement that survives after the operational need has changed.

Technical breakdown

Why software inventory and visibility are not the same

Software inventory answers what is present. Visibility answers whether the organisation knows who is using the application, whether the licence is still valid, whether the tool is underused, and whether it should still exist in the estate. The article’s examples of idle SaaS, shadow IT, and expired licences show that a spreadsheet or asset list can be accurate and still fail governance. SAM only works when discovery, usage telemetry, entitlement data, and renewal status are connected into one operational view.

Practical implication: Build a single control view that links installed software, active usage, licence entitlement, and renewal state.

How licence entitlement governs software access

A software licence is not just a commercial contract. It is an access boundary that defines who may use an application, on which device, under what terms, and with what renewal conditions. The article’s discussion of ISO 19770-2 and ISO 19770-3 reinforces that installed software tags and entitlement tags are what make compliance measurable. Without that linkage, organisations cannot tell whether usage is authorised, excess, or stale, which turns software governance into guesswork.

Practical implication: Normalise entitlement data so every active installation can be matched to a valid licence right.

Why decentralised buying creates governance drift

When business units can acquire software directly, software control fragments. Procurement, usage, and renewal decisions move away from central oversight, and the result is duplicate spend, unmanaged renewals, and orphaned applications. This is the same governance problem identity teams see when access is granted outside the standard lifecycle: local convenience outruns central policy. SAM therefore has to sit inside ITAM and ITSM, not beside them, because the control problem is lifecycle discipline, not just asset counting.

Practical implication: Create a governed intake and approval process for new software purchases before they enter the estate.

NHI Mgmt Group analysis

Visibility is the control, not a reporting output: The article shows that software asset management fails when inventory becomes a static record instead of a live governance signal. Unused applications, shadow IT, and expired licences are all visibility failures before they become cost or compliance failures. The practitioner conclusion is that software governance must be built on operational visibility, not retrospective spreadsheets.

Software entitlement behaves like an access boundary: The guide makes clear that licences define who may use software, on what device, and under what conditions. That makes software entitlement structurally similar to identity authorisation, even when the asset being governed is an application rather than a user. The implication for IAM and IGA teams is that software control and access control belong to the same governance conversation.

Decentralised software buying creates lifecycle drift: When departments can acquire applications without central oversight, renewal, retirement, and compliance obligations detach from the people actually using the software. That is not just procurement sprawl. It is lifecycle drift, where the system of record no longer matches the operational estate. The practitioner lesson is that governance must follow the software lifecycle from acquisition to disposal.

ISO 19770 matters because it makes software governance auditable: The article’s reference to software identification and entitlement tagging shows why SAM programmes need structured records rather than informal ownership claims. Identification tags answer what is installed, and entitlement tags answer what is legally usable. The practitioner conclusion is that audit readiness depends on reconcilable records, not on periodic clean-up exercises.

Identity and software governance converge at usage control: The article repeatedly returns to the same operational truth: what is purchased, what is installed, and what is used are different states. That distinction is central to both identity governance and SAM because rights decay when usage is not continuously matched to entitlement. The field should treat software visibility as part of broader access intelligence, not as a separate admin function.

What this signals

Software control becomes a lifecycle problem once buying decentralises: When business units can acquire applications directly, the organisation loses the clean line between purchase, use, and retirement. The practical response is to govern software like any other identity-bound entitlement, with ownership and expiry tied to a defined process rather than informal administration.

Audit readiness depends on reconciled records, not broad assurance: The article’s emphasis on licence terms, identification tags, and entitlement tags shows that software governance becomes defensible only when every installation can be tied back to a valid right to use it. That is the difference between a reportable posture and an audit surprise.

For practitioners

• Centralise software discovery Use discovery tools to build a system of record for installed applications, active usage, and ownership so shadow IT is visible before renewal decisions are made.
• Reconcile entitlements to installations Match every installed application to a valid licence or entitlement tag, then flag anything unlicensed, over-licensed, or missing from the repository.
• Define a software intake process Require procurement, documentation, and ownership approval before new software can enter the environment, including a defined renewal and retirement path.
• Track usage before renewing spend Use usage metrics to identify idle or underused applications, then remove or reassign licences before the next billing or audit cycle.
• Separate installed, used, and entitled states Review each application against these three states so teams stop treating presence in the estate as proof of legitimate use.

Key takeaways

• Software asset management fails when visibility into usage, entitlement, and renewal is missing, not simply when inventory is incomplete.
• The article shows that shadow IT, idle SaaS, and expired licences are all symptoms of lifecycle drift across procurement, deployment, and retirement.
• The most effective control is a reconciled system of record that links discovery, entitlement, and ownership before renewal and audit decisions are made.

Key terms

• Software Asset Management: Software asset management is the process of tracking, optimising, and governing software usage, licences, and contracts across an organisation. In modern SaaS environments, it increasingly depends on identity data because software value and software risk are both defined by who or what can use the application.
• Software Entitlements: Software entitlements are the rights an organization has to use software under contracts, subscriptions, or licenses. They are not the same as installation data. Security, procurement, and asset management teams use entitlements to compare what was purchased or authorized against what is actually deployed and consumed.
• Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.
• License Optimisation: License optimisation is the process of matching software entitlements to actual use so organisations do not pay for access they no longer need. In identity terms, it is a governance function because entitlement reduction often requires review, downgrade, or deprovisioning decisions.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.