Notifications
Clear all
Topic starter
09/07/2026 3:31 pm
TL;DR: Europe’s tech sector is being positioned around trust, compliance, and digital sovereignty as regulatory pressure, SaaS sprawl, and rising governance demands reshape operating models, according to Matrix42. The practical implication is that software visibility and control are becoming board-level identity and access questions, not just procurement hygiene.
NHIMG editorial — based on content published by Efecte: Shifting Power, Why 2025 Is the EU Tech Sector’s Moment to Lead
Questions worth separating out
Q: How should organisations govern SaaS sprawl without losing access control?
A: They should tie application rationalisation to identity governance, not treat it as a separate IT hygiene exercise.
Q: Why does shadow IT create identity risk, not just cost inefficiency?
A: Shadow IT often brings its own login stores, service credentials, and provisioning processes, which breaks central visibility.
Q: What should security teams measure in SaaS governance programmes?
A: They should measure ownership completeness, access review coverage, deprovisioning speed, and the percentage of SaaS tools tied to central identity controls.
Practitioner guidance
- Consolidate SaaS ownership and access review into one workflow Build a single inventory that ties each application to a business owner, an identity source, and a recurring review cadence so access decisions do not drift across teams.
- Map cross-border data and admin access paths for each SaaS tenant Document where data is processed, which regions host the tenant, and which vendors or subcontractors can administer the environment before approving expansion into regulated workflows.
- Eliminate shadow IT before it becomes lifecycle debt Require discovery of unsanctioned tools through expense, CASB, and SSO telemetry, then force every found application through a lifecycle decision: approve, migrate, or retire.
What's in the full article
Efecte's full post covers the operational detail this post intentionally leaves for the source:
- How the platform presents SaaS inventory and categorisation by region of origin for operational decision-making
- How Finance, IT, and Procurement teams use unified software views to remove redundancies and tighten approval workflows
- How compliance and data residency reporting are structured for cross-border governance conversations
- How the vendor frames control visibility for organisations trying to align software estates with regional requirements
👉 Read Efecte's analysis of EU tech sovereignty and SaaS governance →
EU tech sovereignty and SaaS governance: what should teams change?
Explore further
09/07/2026 3:52 pm
SaaS sprawl is now an identity governance problem disguised as software management. The article correctly frames redundancy and shadow IT as strategic concerns, but the deeper issue is entitlement fragmentation across too many applications and approval paths. When access decisions are spread across disconnected SaaS tools, organisations lose the ability to certify access consistently. Practitioners should treat application rationalisation as a prerequisite for reliable identity governance.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to The State of Secrets in AppSec.
A question worth separating out:
Q: Who is accountable when SaaS governance fails across jurisdictions?
A: Accountability should sit with the business owner, the identity team, and the data governance lead, because sovereignty failures usually span all three. Regulatory obligations may differ by region, but the operational failure is the same: no one can prove who had access, where data moved, or why the control was accepted.
👉 Read our full editorial: EU tech sovereignty and SaaS governance are converging in 2025
