Topic starter
12/06/2026 1:08 am
TL;DR: SaaS environments create identity and access blind spots through orphaned subscriptions, weak transparency, and uneven control over third-party access, according to Zluri's analysis. The security model fails when teams treat SaaS as vendor-managed infrastructure instead of a governed identity surface that needs continuous oversight.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “Let’s talk about SaaS security and why you must be proactive”.
By the numbers:
- 71% of businesses had orphaned SaaS subscriptions, according to Zluri's cited Ping Identity study.
Key questions
Q: How should teams govern SaaS security when the vendor manages the application stack?
A: Treat SaaS as a governed identity surface rather than a fully outsourced control environment.
Q: What breaks when SaaS subscriptions are left orphaned?
A: Orphaned subscriptions create access that no one can confidently explain, review, or retire.
Q: How should security teams spot suspicious third-party access in SaaS environments?
A: Watch for new OAuth grants, unexpected scope expansion, token creation, and bursts of enumeration across connected applications.
Practitioner guidance
- Map every SaaS application to an accountable owner Maintain a live inventory that ties each SaaS app to a business owner, security owner, and removal trigger so orphaned subscriptions can be retired quickly.
- Build SaaS access into joiner-mover-leaver workflows Extend onboarding, role change, and offboarding processes into the application layer so access changes are not left behind in dormant subscriptions.
- Review third-party access paths and service delivery roles Document which vendors, partners, and support teams can touch SaaS data, then verify those paths are still justified and approved.
Bottom line: SaaS security fails when organisations let application ownership and access governance drift apart from identity operations.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 10:51 am
SaaS security is an identity governance problem before it is an application security problem. The article shows that the real failure mode is not the software model itself but the absence of continuous control over entitlements, ownership, and third-party access. Once SaaS becomes the operating layer for core business functions, identity governance has to extend into every app instance, not sit outside it. Practitioners should treat SaaS as a governed access surface, not a vendor-managed exception.
A few things that frame the scale:
- 1 in 3 organisations encountered suspicious AI agent activity in 2025, and 99.4% experienced a SaaS or AI ecosystem incident.
A question worth separating out:
Q: Why do organisations need continuous visibility across SaaS applications?
A: Because SaaS risk is distributed across subscriptions, identities, integrations, and data-sharing paths. Continuous visibility is what lets teams detect stale access, policy drift, and hidden third-party exposure before they become audit findings or data incidents. Without it, governance becomes reactive and incomplete.
👉 Read our full editorial: SaaS security demands proactive identity governance and visibility
This post was modified 4 days ago by NHI Mgmt Group