TL;DR: SaaS management tools still leave gaps in discovery, usage visibility, and access control, especially where shadow IT and unmanaged subscriptions create security and cost risk, according to Zluri. The real issue is not tool selection alone, but whether governance can keep pace with hidden SaaS identities and their access paths.
At a glance
What this is: This is a comparison-style analysis of Zylo alternatives that finds SaaS management still breaks down where discovery, usage visibility, and access governance do not fully cover shadow IT and unmanaged subscriptions.
Why it matters: It matters because IAM, IGA, and SaaS governance teams need more than cost optimisation. They need control over who can access SaaS, which accounts exist, and whether usage and compliance signals are trustworthy enough to support decisions.
Context
SaaS identity governance is the discipline of discovering SaaS applications, understanding which identities and accounts use them, and controlling access and lifecycle changes when subscriptions move outside IT visibility. When discovery is incomplete or usage telemetry depends on only one identity source, the governance model becomes partial and the organisation cannot confidently manage shadow IT.
Zluri's article frames the problem as a tool-selection question, but the underlying issue is governance coverage. The article repeatedly points to gaps in integrations, usage data, benchmark data, and access visibility, which are the same weak points that let unmanaged SaaS identities persist outside normal IAM and IGA processes.
Key questions
Q: What breaks when SaaS discovery is incomplete?
A: Incomplete discovery leaves shadow apps, duplicate subscriptions, and employee-purchased tools outside the control model. That means invoices cannot be matched cleanly, renewal decisions are based on partial data, and ownership remains ambiguous. In practice, the organisation pays for services it cannot reliably govern or retire.
Q: Why do shadow IT apps create more than a cost problem?
A: Because every unmanaged app can create identities, permissions, and renewal obligations that bypass lifecycle controls. The risk is not only wasted spend. It is that access can persist without ownership, recertification, or timely revocation, which turns shadow IT into governance debt.
Q: How do you know if SaaS usage data is trustworthy enough for renewals?
A: Usage data is trustworthy only when it reconciles across the main identity and application pathways in the estate. If the platform depends on one login source, direct access and alternate sign-in routes can disappear from the record, which makes renewal and reclamation decisions unreliable.
Q: What should IAM teams do when SaaS access sits outside normal review cycles?
A: Bring those accounts into the same ownership, recertification, and offboarding process used for other access that matters. If unmanaged SaaS identities are left outside governance, they become persistent exceptions that weaken least privilege and create audit gaps.
Technical breakdown
Why SaaS discovery fails when integrations are incomplete
SaaS discovery is not just a list-building exercise. It depends on multiple telemetry sources, including identity providers, direct app integrations, browser extensions, and other signals that reveal apps, users, and accounts. When coverage depends too heavily on one source, hidden subscriptions, unmanaged logins, and orphaned access remain invisible. That creates a governance blind spot, because inventory accuracy and identity visibility are coupled. In practice, the technical problem is not whether a tool can count apps, but whether it can resolve the full relationship between apps, identities, and active access paths across the estate.
Practical implication: validate which discovery sources actually feed your SaaS inventory before you trust the result.
How usage visibility breaks when one identity source dominates
Usage analytics for SaaS often look precise while still missing real behaviour. If a platform depends mainly on a single identity source, such as one SSO or one IdP path, it will miss activity that occurs through alternative sign-in routes, direct logins, or unmanaged accounts. The result is distorted adoption data, weak reclaim decisions, and poor renewal evidence. For governance teams, that means usage cannot be treated as a reliable proxy for control if the telemetry is narrow. Access decisions should be grounded in multi-source evidence, not a single login channel.
Practical implication: require usage reporting to reconcile across identity and application sources before you retire licences or approve renewals.
What unmanaged SaaS access means for governance and compliance
Shadow IT is an identity problem as much as a procurement problem. Unauthorised apps create accounts outside approved lifecycle processes, which means access can exist without ownership, review, or timely offboarding. That undermines compliance claims, complicates least-privilege enforcement, and increases the chance of dormant access surviving long after business need has ended. In SaaS environments, the governance gap is not just that apps are unknown. It is that the identities attached to those apps often sit outside recertification, role management, and termination workflows.
Practical implication: bring unmanaged SaaS accounts into the same lifecycle and review processes you already use for other privileged access.
Breaches seen in the wild
- SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
SaaS governance fails when discovery is treated as inventory instead of identity resolution: The article shows that the real gap is not simply finding more apps, but understanding which identities, subscriptions, and access paths sit behind them. When discovery is narrow, hidden accounts and unmanaged sign-ins remain outside governance. Practitioners should read this as a control coverage problem, not a tooling preference debate.
Usage visibility is only useful when it survives channel diversity: If SaaS activity is inferred from one login path, the organisation will undercount real use and overtrust false confidence. That matters for licence optimisation, renewal decisions, and access reviews, because each of those processes depends on complete evidence. The practical lesson is that telemetry quality is now a governance control, not a reporting feature.
Shadow IT creates lifecycle debt in SaaS access: Once applications are adopted without IT knowledge, the identities attached to them often bypass joiner-mover-leaver controls, review cadences, and offboarding. That means orphaned access can outlive business need even when the app itself is visible later. Teams should treat unmanaged SaaS as governance debt that accumulates until it is explicitly absorbed into lifecycle control.
Identity governance for SaaS now sits at the intersection of access, spend, and compliance: The article makes clear that licence optimisation alone is not enough if access remains partially observable. That combination forces IAM and IGA teams to work more closely with procurement and SaaS management, because the control objective is no longer just cost reduction. Practitioners should align SaaS visibility with access governance and review ownership together.
Comprehensive SaaS control demands evidence across identity sources, not vendor claims: The article's comparisons show how easily platform narratives can overstate coverage when integrations are uneven. For governance teams, the important question is whether the platform can prove who used what, through which identity path, and under what lifecycle state. Practitioners should demand that evidence before accepting a SaaS management control as complete.
What this signals
SaaS identity governance is moving from app counting to access assurance: The useful question is no longer how many apps exist, but whether the organisation can prove who is using them, how they signed in, and whether those identities are still entitled. That pushes SaaS management closer to IAM and IGA, where evidence quality matters as much as coverage.
Hidden SaaS access creates review debt: When applications are adopted outside approved processes, the resulting accounts often miss certification, offboarding, and role cleanup. The longer that gap persists, the more likely teams are to confuse active use with authorised use, which weakens both security and compliance outcomes.
For practitioners
- Map all SaaS discovery sources Document which identity providers, app integrations, browser signals, and desktop agents feed the inventory so you can see where hidden apps could still evade detection.
- Reconcile usage across sign-in paths Compare SSO-based telemetry with direct logins and app-native records before using usage data for renewals, reclamation, or access decisions.
- Pull unmanaged SaaS into lifecycle control Treat discovered shadow IT apps as identities that need ownership, review, and offboarding, not just procurement cleanup.
- Test access review evidence quality Verify that every access review can show complete account coverage, not only the accounts visible through one integration path.
Key takeaways
- SaaS management tools can reduce spend, but they still leave a governance gap when discovery and usage telemetry do not cover the full identity surface.
- Shadow IT matters because it creates accounts and access paths that can escape lifecycle controls, not just because it wastes budget.
- Practitioners should evaluate SaaS platforms by how well they support identity coverage, evidence quality, and offboarding, not only by inventory breadth.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 — Vulnerable Third-Party NHI | SaaS apps and integrations create third-party access paths that can evade governance. |
| NHI-01 — Improper Offboarding | Unmanaged SaaS accounts persist when offboarding and lifecycle controls do not cover shadow IT. | |
| Recommendation — Assess SaaS integrations and connected accounts for third-party access risk before trusting them in production. Extend offboarding workflows to all SaaS accounts and revoke access when ownership changes or apps disappear. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about whether SaaS entitlements are visible and governed. |
| Recommendation — Review SaaS entitlements against PR.AA-05 and close access paths that lack clear authorization evidence. | ||
| CIS Controls v8 | CIS-5 — Account Management | Shadow IT creates unmanaged accounts that fall outside account management processes. |
| Recommendation — Bring SaaS accounts into account management so lifecycle ownership, review, and revocation are enforced. | ||
| MITRE ATT&CK | TA0007;TA0008 — Discovery; Lateral Movement | Hidden SaaS access and unmanaged identities support adversary discovery and movement across services. |
| Recommendation — Map unmanaged SaaS exposure to TA0007 and TA0008 to prioritise accounts that widen movement paths. | ||
Key terms
- SaaS Identity Risk: SaaS identity risk is the chance that identities used to access software delivered over the internet are misused, overprivileged, or poorly governed. It includes human users, service accounts, API tokens, and connected apps. Technical risk arises when authentication, authorization, lifecycle control, or monitoring fails across tenant, application, and integration boundaries.
- Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.
- Usage Telemetry: Usage telemetry is activity data that shows whether a user or organisation is actually using a SaaS application or licence. It helps teams distinguish active business value from dormant entitlement, and it is most useful when combined with ownership and lifecycle records.
- Access Review: A formal process for confirming whether access is still needed and justified. In IAM programs, the review becomes an evidence-bearing control when decisions are recorded, scoped correctly, and traceable to the right reviewer, application owner, or auditor.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on June 10, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org