Notifications
Clear all
Topic starter
11/06/2026 11:39 pm
TL;DR: Decentralised SaaS environments increase app sprawl, duplicate purchasing, and lingering access when onboarding and offboarding are not systematised, according to Zluri. The governance failure is not SaaS adoption itself, but the loss of visibility, ownership, and role-bound access as employees self-provision tools outside IT control.
NHIMG editorial — based on content published by Zluri: 5 Best Practices for Managing a Decentralised SaaS Environment
By the numbers:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected.
Questions worth separating out
Q: How should security teams govern decentralised SaaS app adoption?
A: Security teams should treat decentralised SaaS adoption as an identity governance problem, not just an app selection problem.
Q: Why do decentralised SaaS environments create offboarding risk?
A: They create offboarding risk because app access can be created outside central IT and then forgotten when the employee leaves or changes role.
Q: What do organisations get wrong about self-service SaaS procurement?
A: They often assume self-service means giving employees unrestricted choice.
Practitioner guidance
- Build a single SaaS discovery inventory Reconcile procurement, browser, SSO, and finance signals into one application register so shadow usage and duplicate tools do not stay hidden across teams.
- Attach provisioning and deprovisioning to every approved app Create a formal workflow for onboarding, access changes, and revocation so access removal happens when employees move roles or leave the organisation.
- Define app ownership for every sanctioned service Assign an accountable business owner and technical owner to each application so access decisions, review cadence, and offboarding actions have clear responsibility.
What's in the full article
Zluri's full blog post covers the operational detail this post intentionally leaves for the source:
- App discovery methods and how they are used to identify shadow SaaS across the organisation
- Workflow examples for onboarding and offboarding users in a decentralised environment
- How the Employee App Store presents app security and compliance data to employees
- How app ownership, risk scoring, and approval workflows are handled in the platform
👉 Read Zluri's best practices for managing decentralised SaaS governance →
Decentralised SaaS governance: where access control breaks down?
Explore further
12/06/2026 8:25 am
Decentralised SaaS governance is fundamentally a lifecycle problem, not a procurement problem. The article frames app sprawl and duplicate buying as the visible symptoms, but the real failure is that identity governance no longer knows when access begins, changes, or ends. That puts joiner-mover-leaver discipline at the centre of SaaS control. Practitioners should treat every unmanaged app as an unresolved lifecycle record.
A few things that frame the scale:
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks, according to the 2024 ESG Report: Managing Non-Human Identities.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected.
A question worth separating out:
Q: How can role-based access control reduce SaaS governance risk?
A: RBAC reduces risk when roles are mapped to real business duties and enforced at the application and data layer. It should prevent users from reaching functions outside their job scope, such as finance data for non-finance teams. If roles are vague or loosely applied, RBAC becomes a label, not a control.
👉 Read our full editorial: Decentralised SaaS governance exposes access and offboarding gaps
