Topic starter
11/07/2026 1:57 pm
TL;DR: Enterprises now average more than 1,000 SaaS apps, up 26% in two years, while 80% of employees admit to using unauthorized SaaS or AI apps that contribute to about 35% of data breaches, according to SentinelOne. The governance gap is not just app sprawl, but loss of visibility into identities, data flows, and third-party access boundaries.
Editorial analysis by NHI Mgmt Group, based on content published by SentinelOne: “Securing the SaaS Frontier in the Era of AI and Agents | S Ventures’ Investment in Reco”.
By the numbers:
- Enterprises now average more than 1,000 SaaS apps, up 26% in two years.
- 80% of employees admit to using unauthorized SaaS or AI apps.
- Unauthorized SaaS or AI apps contribute to about 35% of data breaches.
Key questions
Q: Why do SaaS sprawl and identity governance fail in the same place?
A: They both depend on discovery happening before control.
Q: Why do unapproved SaaS and AI apps create identity risk?
A: They create risk because access can be granted once and then continue operating outside normal identity controls.
Q: How should security teams govern shadow AI in SaaS environments?
A: Security teams should inventory AI-enabled features, classify the data those features can touch, and enforce approved-use rules at the application and identity layers.
Practitioner guidance
- Inventory SaaS and AI access paths continuously Track sanctioned and unsanctioned applications, integrations, and assistant-style tools together so identity, data, and delegation paths are visible in one programme.
- Review delegated access as an identity control Include OAuth grants, API tokens, and third-party app links in access governance, because these pathways create durable privilege even when the app itself looks benign.
- Classify shadow AI as a governance exception Require owners, business purpose, and expiry for any AI tool that can read, transform, or move enterprise data, even if it sits inside a familiar SaaS workflow.
Bottom line: The core risk is not simply more software, but more hidden identity and data pathways than legacy controls can track.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:08 pm
SaaS sprawl has become an identity governance problem, not just an inventory problem. Once enterprises cross the threshold into hundreds or thousands of SaaS services, the main control failure is no longer procurement sprawl but access opacity. Security teams cannot govern what they cannot enumerate, and that leaves entitlement review, third-party oversight, and offboarding incomplete. The practitioner conclusion is that SaaS governance now belongs in identity operating models, not only in application lists.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How can organisations tell whether SaaS access governance is actually working?
A: They should look for three signals: low numbers of orphaned accounts, consistent entitlement recertification, and rapid revocation when users change roles or leave. If access remains valid across apps after a lifecycle event, governance is not working even if dashboards look complete.
👉 Read our full editorial: SaaS sprawl and shadow AI are exposing enterprise identity gaps