Notifications
Clear all
Topic starter
12/06/2026 1:19 am
TL;DR: SaaS licensing is framed as a procurement problem, but Zluri’s analysis shows it quickly becomes an identity and governance problem when visibility, renewal control, and access allocation break down across a large application stack. The real issue is not just cost leakage but unmanaged access that expands shadow IT, compliance exposure, and security risk.
NHIMG editorial — based on content published by Zluri: SaaS licenses explained and practical considerations for IT teams
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: How should organisations govern SaaS licenses as part of IAM and IGA?
A: Treat SaaS licenses as governed entitlements, not just commercial line items.
Q: Why do SaaS license sprawl and shadow IT create security risk?
A: Because every unsanctioned app adds accounts, admins, and integrations that sit outside central visibility.
Q: What breaks when SaaS renewal management is disconnected from usage data?
A: Organisations keep paying for seats that no longer support a business need and preserve access that should have been removed.
Practitioner guidance
- Tie license approvals to identity ownership Require every new SaaS subscription to have a named business owner, an IAM owner, and a renewal date aligned to access review cadence.
- Reconcile spend data with identity inventory Compare procurement records, app discovery data, and account inventories each month to identify apps with no active owner, no recent usage, or no offboarding path.
- Use renewal windows for entitlement cleanup Before any contract renews, validate seat usage, admin accounts, and integrations that depend on the application.
What's in the full article
Zluri's full blog covers the operational detail this post intentionally leaves for the source:
- Detailed pricing-model comparisons for per-user, per-feature, and usage-based licensing
- Expanded discussion of enterprise versus end-user license trade-offs for procurement teams
- Longer explanation of SaaS agreement terms, renewals, and service-level commitments
- Practical license-management examples tied to inventory, usage, and optimisation workflows
👉 Read Zluri's guide to SaaS license types and management →
SaaS license sprawl: what IAM teams need to fix first?
Explore further
12/06/2026 11:08 am
SaaS licensing has become an identity governance issue, not just a commercial one. Once software access is sold as seats, features, or usage, the licence becomes a proxy for entitlement management. That means procurement decisions directly affect access review quality, offboarding accuracy, and shadow IT exposure. The implication is that SaaS licence administration now belongs in the same governance conversation as access certification and lifecycle control.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to the Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: Who should own SaaS license decisions when multiple teams are involved?
A: Procurement can manage the contract, but IAM or IGA should own the access implications, while the business owner validates need. Shared ownership is the only way to keep licenses aligned with actual use, revocation rules, and audit expectations.
👉 Read our full editorial: SaaS license governance is now an identity control problem
