Topic starter
12/06/2026 9:07 pm
TL;DR: Broader discovery methods improve SaaS visibility, shadow IT detection, and access oversight across SSO, finance, browser, device, and directory signals, according to Zluri’s comparison with Trelica. The underlying issue is not tool count but whether identity programmes can actually see unmanaged SaaS and act on it before risk becomes normalised.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “Zluri vs Trelica: Which SaaS Management Platform Is Better?”.
Key questions
Q: How should security teams govern shadow IT in SaaS environments?
A: Security teams should govern shadow IT by treating it as unmanaged access, not just unsanctioned software.
Q: Why do shadow SaaS apps create IAM risk?
A: Shadow SaaS creates IAM risk because access can exist outside approved onboarding, review, and offboarding processes.
Q: What are the signs that SaaS discovery is missing part of the environment?
A: Common signs include apps used outside SSO, tools appearing only in browser or email data, and gaps created by mobile, incognito, VPN, or unmanaged devices.
Practitioner guidance
- Expand discovery beyond SSO data Correlate identity provider logs with finance, browser, endpoint, mobile, and directory signals so unmanaged SaaS can be identified from multiple angles, not one.
- Treat shadow IT as a governance input Feed newly discovered SaaS apps into app ownership, access review, and offboarding workflows so hidden tools do not remain outside lifecycle control.
- Validate the completeness of your SaaS inventory Compare approved applications against browser activity, expense records, and directory-linked usage to find gaps that a single source of truth will miss.
Bottom line: SaaS discovery is an identity governance problem when hidden applications sit outside the authoritative inventory and bypass normal review paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
12/06/2026 10:59 pm
Broader SaaS discovery has become an identity governance requirement, not a software-admin convenience. When the application estate is incomplete, every downstream identity process starts from a partial truth. Access reviews, offboarding, and compliance checks can only govern what discovery surfaces, so shadow IT is really an inventory failure with IAM consequences.
A few things that frame the scale:
- The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.
A question worth separating out:
Q: How should teams compare SaaS discovery methods across platforms?
A: Compare them by the number and quality of independent signals they can reconcile, not by feature names alone. A useful discovery model should combine identity, finance, browser, device, and directory views so hidden apps can be detected from different entry points. If a method only confirms known usage, it is not sufficient for shadow IT governance.
👉 Read our full editorial: SaaS discovery and shadow IT visibility remain IAM blind spots
This post was modified 6 days ago by NHI Mgmt Group