Software license optimization exposes the SaaS governance gap

At a glance

What this is: This is an analysis of ROSS, Zluri's framework for measuring SaaS value through pricing, latent value, and future roadmap fit, with the central finding that license optimization exposes a broader SaaS governance gap.

Why it matters: It matters because IAM, IGA, and SaaS governance teams have to measure app value, entitlement waste, and lifecycle control together if they want to reduce spend without creating access sprawl.

Context

Software license optimization is not just a cost exercise. In this article, the real issue is whether organisations can actually see, rationalise, and govern SaaS entitlement usage across departments, users, and overlapping apps.

The governance gap appears when teams know what they are paying for but not what they are consuming, duplicating, or failing to retire. That makes SaaS spend a proxy for identity control quality, because application value and entitlement lifecycle are tightly linked.

ROSS, or Return on SaaS Stack, is presented as a way to compare SaaS value across pricing, latent value, and future roadmap fit. The operational question is whether the SaaS stack can be measured well enough to support defensible access, renewal, and rationalisation decisions.

Key questions

Q: How should IAM and governance teams measure SaaS stack value?

A: They should measure value across usage, workflow fit, renewal risk, and ownership clarity, not just subscription cost. A SaaS platform can be cheap and still create waste if it is duplicated, underused, or impossible to rationalise. The practical test is whether the organisation can prove why each app exists and who benefits from it.

Q: Why do duplicate SaaS apps create identity governance risk?

A: Duplicate apps split ownership, permissions, and data flows across multiple systems that perform the same job. That makes access certification less reliable, offboarding harder, and audit evidence weaker because reviewers cannot clearly identify the authoritative control point for a given business function.

Q: How should teams govern SaaS subscriptions that no one actively uses?

A: Treat them as lifecycle objects, not just cost items. Every dormant subscription should still have an owner, a renewal decision, and a removal path. If a subscription has no current business purpose, the associated app accounts, roles, and integrations should be retired through the same governance process used for other access cleanup.

Q: When does SaaS value assessment become a lifecycle issue?

A: It becomes a lifecycle issue when apps outlive the teams, workflows, or integrations that justified them. At that point, the question is no longer just spend, but whether the application is still governed through inventory, ownership, access review, and offboarding. That is where rationalisation turns into identity discipline.

Technical breakdown

Pricing waste is an entitlement governance problem

Pricing in this article is not just vendor cost. It is the mismatch between what was procured and what is actually used, including duplicate subscriptions, wrong plans, and hidden charges. In IAM terms, that is a visibility and lifecycle issue because unused apps and redundant licenses often persist when access decisions are not tied to usage evidence. The article also points to department-level and individual-level usage as the signal needed to rationalise spend. That makes license optimisation dependent on identity-aware app visibility, not finance reporting alone.

Practical implication: connect app usage data to entitlement reviews so renewals reflect actual consumption rather than assumed demand.

Latent value depends on interoperability and workflow reach

Latent value here means the value created when SaaS applications exchange data, automate work, and support broader workflows. The article treats data movement, automation, integrations, and reporting as part of the value calculation, but it also acknowledges that these capabilities introduce coordination, performance, and data movement concerns. For IAM and governance teams, this matters because app value now depends on how well access, data flows, and connected services are controlled across the stack. The more an app sits inside workflows, the more its identity relationships affect business value.

Practical implication: evaluate whether access governance covers connected apps and data flows, not just named user seats.

Future roadmap changes the renewal decision

The article frames future roadmap as a practical part of value assessment, because today’s app may fail tomorrow’s business needs or become a feature commodity. That is a governance problem as much as a product problem, since renewal decisions should account for whether the current SaaS stack can support upcoming scale, workflow changes, and data protection expectations. The article also warns that roadmap visibility is often limited, which leaves teams relying on historical performance and current fit. That makes renewal and rationalisation decisions inherently uncertain unless governance teams can compare present usage with future operating requirements.

Practical implication: include roadmap fit and lock-in risk in SaaS reviews so renewals are tied to forward-looking business needs.

NHI Mgmt Group analysis

Software license optimisation is really SaaS governance under a financial label: the article shows that spend reduction, app rationalisation, and entitlement control are the same problem viewed from different angles. If teams cannot distinguish unused subscriptions from genuinely embedded business services, they will optimise cost while leaving access sprawl intact. The practitioner conclusion is that SaaS financial management and identity governance have to be assessed together.

ROSS exposes a named concept we would call SaaS value opacity: organisations can often see invoices, but not the business usefulness, workflow dependency, or lifecycle burden of each application. That opacity is what allows duplicate tools, hidden costs, and renewal drift to persist. The implication is that value measurement must become part of governance design, not just procurement review.

Interoperability has become an identity control issue, not just an integration issue: once applications exchange data, trigger automation, and support cross-platform workflows, access and entitlement decisions influence operational value directly. The article makes clear that modern SaaS stacks are judged by how well they connect, not merely by whether they are deployed. The practitioner conclusion is that governance teams must treat app connectivity as part of the control surface.

Future roadmap fit is now a governance criterion for SaaS renewal: the article argues that past performance and current feature sets do not reliably predict whether a platform will support next-year needs. That means renewal decisions based only on current usage miss lock-in risk, feature drift, and future business misalignment. The practitioner conclusion is that SaaS oversight needs a forward-looking review cycle, not a retrospective spend check.

Identity governance should own the lifecycle side of SaaS rationalisation: unused subscriptions, duplicate apps, and weak visibility are not just procurement inefficiencies, they are signs that app lifecycles are not being governed tightly enough. That makes entitlement review, offboarding, and application inventory central to value measurement. The practitioner conclusion is that rationalisation programmes should be run with IGA discipline, not only finance reporting.

From our research library:

• The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.

What this signals

SaaS value opacity: procurement data can show what was bought, but not whether the app is still delivering enough business value to justify its place in the stack. That is why rationalisation programmes fail when they stop at spend analysis and never reach ownership, usage, and renewal governance.

The practical shift for identity teams is to treat SaaS rationalisation as part of lifecycle governance. If an application is not tied to a clear owner, a current use case, and a renewal decision path, it will drift into waste even when the spend looks defensible on paper.

For practitioners

• Map SaaS usage to entitlement ownership Build a current inventory of apps, licenses, and named owners so renewal decisions can be tied to actual use, department need, and business criticality.
• Identify duplicate tools by business function Compare apps serving the same use case, then decide which one should remain based on adoption, workflow fit, and migration friction rather than habit.
• Review hidden costs in renewal cycles Include data migration effort, feature bloat, add-on pricing, and integration overhead in every SaaS renewal review so the real cost of ownership is visible.
• Tie SaaS rationalisation to IGA reviews Use access reviews and offboarding workflows to remove dormant subscriptions and reconcile app ownership when users, teams, or vendors change.
• Score roadmap fit before committing spend Assess whether each platform can support next-year workflow, automation, and scale requirements before approving long-term renewal or expansion.

Key takeaways

• The article shows that software license optimisation is fundamentally a SaaS governance problem, because unused apps, duplicate tools, and hidden costs persist when ownership and lifecycle visibility are weak.
• ROSS is used to compare applications by pricing, latent value, and future roadmap fit, which shifts the conversation from vendor spend to measurable business value.
• The practical implication is to bring IGA discipline into SaaS renewal and rationalisation so that access, usage, and retirement decisions stay aligned.

Key terms

• Return on SaaS Stack (ROSS): A framework for judging the value a SaaS portfolio delivers relative to what the organisation pays and operates. It combines cost, workflow usefulness, and future fit so teams can compare applications more consistently. In governance terms, it is a decision aid, not a universal financial metric.
• SaaS Value Opacity: The condition where organisations can see spend and subscriptions but cannot clearly see business value, workflow dependency, or ownership quality. This often leads to duplicate tools, dormant licenses, and unclear renewal decisions. In identity programmes, it usually signals weak lifecycle visibility across the application estate.
• Entitlement Rationalization: Entitlement rationalization is the work of translating different application-specific permissions into a common language that governance systems can evaluate. It is often the hidden effort in IGA deployments, because inconsistent schemas and role models must be normalised before decisions can be trusted.
• SaaS Lifecycle Governance: SaaS lifecycle governance is the set of controls that manage applications from onboarding through access assignment, renewal, and decommissioning. It matters because the security value of SaaS management depends on whether the organisation can prove ownership, revoke access, and retire unused tools on demand.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.