Topic starter
11/07/2026 1:57 pm
TL;DR: 1,000 SaaS apps now average across enterprises, and 80% of employees admit using unauthorized SaaS or AI apps, SentinelOne survey data shows. Identity governance has to cover delegated access and third-party data paths, not just approved app lists.
Editorial analysis by NHI Mgmt Group, based on content published by SentinelOne: “Securing the SaaS Frontier in the Era of AI and Agents | S Ventures’ Investment in Reco”.
By the numbers:
- Enterprises now average more than 1,000 SaaS apps, up 26% in two years.
- 80% of employees admit to using unauthorized SaaS or AI apps.
- Unauthorized SaaS or AI apps contribute to about 35% of data breaches.
Key questions
Q: Why do unapproved SaaS and AI apps create identity risk?
A: They create risk because access can be granted once and then continue operating outside normal identity controls.
Q: How should security teams govern shadow AI in SaaS environments?
A: Security teams should inventory AI-enabled features, classify the data those features can touch, and enforce approved-use rules at the application and identity layers.
Q: Why do SaaS sprawl and identity governance fail in the same place?
A: They both depend on discovery happening before control.
Practitioner guidance
- Inventory SaaS and AI access paths continuously Track sanctioned and unsanctioned applications, integrations, and assistant-style tools together so identity, data, and delegation paths are visible in one programme.
- Review delegated access as an identity control Include OAuth grants, API tokens, and third-party app links in access governance, because these pathways create durable privilege even when the app itself looks benign.
- Classify shadow AI as a governance exception Require owners, business purpose, and expiry for any AI tool that can read, transform, or move enterprise data, even if it sits inside a familiar SaaS workflow.
Bottom line: The core risk is not simply more software, but more hidden identity and data pathways than legacy controls can track.
Glossary terms: SaaS Sprawl, Shadow AI, Delegated Access, SaaS-to-SaaS Integration
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 hour ago by NHI Mgmt Group
11/07/2026 2:08 pm
SaaS sprawl has become an identity governance problem, not just an inventory problem. Once enterprises cross the threshold into hundreds or thousands of SaaS services, the main control failure is no longer procurement sprawl but access opacity. Security teams cannot govern what they cannot enumerate, and that leaves entitlement review, third-party oversight, and offboarding incomplete. The practitioner conclusion is that SaaS governance now belongs in identity operating models, not only in application lists.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How can organisations tell whether SaaS access governance is actually working?
A: They should look for three signals: low numbers of orphaned accounts, consistent entitlement recertification, and rapid revocation when users change roles or leave. If access remains valid across apps after a lifecycle event, governance is not working even if dashboards look complete.
👉 Read our full editorial: Unchecked SaaS growth is widening identity and access governance gaps
This post was modified 1 hour ago by NHI Mgmt Group