Topic starter
11/06/2026 11:43 pm
TL;DR: Gartner’s 2025 SaaS Management Platforms report places growing pressure on IT to centralize SaaS control as application sprawl, generative AI usage, overspend, and visibility gaps compound, according to Josys, while Gartner predicts more than 70% of organisations will centralize SaaS application management by 2028. The governance issue is no longer discovery alone: it is whether access, entitlement drift, and lifecycle control can be made durable across a fast-expanding software estate.
Editorial analysis by NHI Mgmt Group, based on content published by Josys: “Josys Recognized in the 2025 Gartner® Magic Quadrant™ for SaaS Management Platforms”.
By the numbers:
- Gartner predicts that through 2028, over 70% of organisations will centralize SaaS application management using a SaaS management platform, an increase from less than 30% in 2025.
- Josys maintained an overall 4.6/5 rating with 78 Reviews on Gartner Peer Insights for SaaS Management Platforms as of 30 August 2025.
Key questions
Q: Why do SaaS management gaps often turn into access governance problems?
A: Because the same blind spots that hide rogue apps also hide who can use them.
Q: Why does SaaS sprawl increase non-human identity risk?
A: SaaS sprawl increases NHI risk because every new integration can create tokens, service accounts, OAuth grants, and delegated permissions that persist outside normal review cycles.
Q: What do security teams get wrong about SaaS spend visibility?
A: They often mistake visibility for control.
Practitioner guidance
- Define a SaaS ownership model Assign each application a business owner, technical owner, and offboarding trigger so access decisions are accountable end to end.
- Reconcile access against actual usage Compare live entitlements, licence utilisation, and admin rights on a regular cadence to expose dormant access and redundant app spend.
- Tie SaaS review to JML workflows Update joiner-mover-leaver processes so SaaS accounts, connected apps, and delegated access are removed or re-assigned when roles change.
Bottom line: SaaS management is drifting into the identity governance domain because app sprawl and delegated access now drive access risk as much as licence cost.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/06/2026 8:32 am
SaaS management is now an identity control plane problem. The article reflects a broader shift in which app sprawl is no longer just a procurement or operations headache. Once SaaS estates become dense enough, governance must cover who can access what, whether that access still matches role and business need, and how quickly stale permissions are removed. Practitioners should stop treating SaaS management as a separate tooling conversation and start treating it as part of identity control design.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.
A question worth separating out:
Q: What should teams do when third-party SaaS access outlives the business need?
A: They should revoke the connection, reassign ownership, and require a fresh approval path before the integration is restored. Third-party SaaS access should be treated as governed access, not permanent convenience. If the business relationship changes, the access relationship must change with it.
👉 Read our full editorial: Josys recognition in Gartner's SaaS management quadrant