Notifications
Clear all
Topic starter
09/07/2026 3:30 pm
TL;DR: AI-assisted software creation is increasing SaaS sprawl, shadow IT, duplicate tools, and unmanaged risk, while Gartner cited in the source warns that organisations without central SaaS lifecycle management will be five times more likely to suffer cyber incidents or data loss by 2027. The control problem is governance and visibility, not innovation speed.
NHIMG editorial — based on content published by Efecte: AI and the New Era of Software Control: Why 2026 Demands a Shift in Mindset
By the numbers:
- Gartner predicts that by 2027, organizations that fail to centrally manage SaaS lifecycles will be five times more likely to suffer cyber incidents or data loss.
- At least 25 percent of SaaS spend will be wasted on unused licenses and overlapping tools.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: How should organisations govern AI-driven SaaS sprawl?
A: They should govern it as an identity and lifecycle problem, not just a procurement issue.
Q: Why does SaaS sprawl increase identity risk?
A: Because every new app can introduce users, admins, API keys, OAuth grants, and service integrations that must be managed over time.
Q: What breaks when SaaS ownership is unclear?
A: Recertification becomes unreliable, offboarding stalls, and duplicate spend grows unnoticed.
Practitioner guidance
- Create a SaaS authoritative inventory Establish a single record for every business-approved application, including owner, business purpose, data sensitivity, renewal date, and integration list.
- Tie SaaS access to lifecycle events Connect onboarding, role changes, and offboarding to application entitlements so access removal happens when ownership changes, not after a quarterly review cycle.
- Review OAuth grants and API integrations routinely Treat application-to-application permissions as governed access paths.
What's in the full article
Efecte's full article covers the operational detail this post intentionally leaves for the source:
- How the source frames AI-assisted software creation as a SaaS governance problem for business leaders.
- The article's specific examples of software sprawl, duplicate contracts, and unmanaged applications.
- The source's explanation of why Europe and GDPR are positioned as a governance advantage in this model.
- Efecte's view of how its own SaaS management platform is positioned for visibility, renewals, and compliance.
👉 Read Efecte's analysis of AI-driven SaaS sprawl and governance →
AI-driven SaaS sprawl: what it means for IAM and governance?
Explore further
09/07/2026 3:51 pm
AI-assisted SaaS creation has turned application sprawl into a governance problem. The source is right to treat the issue as more than software adoption. When employees can create or adopt tools outside formal review, the organisation loses control over ownership, access, and data flow. The practitioner conclusion is simple: SaaS governance now belongs in the same conversation as identity lifecycle and access management.
A few things that frame the scale:
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to the Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who should be accountable for SaaS governance in an AI-driven environment?
A: Accountability should sit with a cross-functional control model led by IT, security, and procurement, with business owners assigned to each application. If no one owns the app, no one owns the access paths, renewals, or offboarding steps either. That is how shadow SaaS becomes a persistent governance gap.
👉 Read our full editorial: AI-driven SaaS sprawl is exposing a new governance gap
