Topic starter
12/06/2026 8:59 pm
TL;DR: SaaS adoption is shifting software consumption to decentralized buying, access, and data ownership, and Zluri argues that traditional ITAM and SAM models cannot keep up with renewal, offboarding, and compliance demands. The identity problem is no longer just software sprawl, but unmanaged access lifecycles across users, data, and SaaS tools.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “The Case for Building a SaaS Management Tool Ground Up”.
By the numbers:
- SaaS is expected to reach $832.1 billion by 2025, according to Zluri.
Key questions
Q: How should security teams handle SaaS applications that are bought outside IT?
A: They should bring those apps into a managed inventory, assign business ownership, and require renewal review before the contract continues.
Q: Why does SaaS sprawl make governance and compliance harder?
A: SaaS sprawl creates multiple independent storage and access decisions across departments, which breaks visibility and weakens auditability.
Q: What breaks when traditional SAM is used for SaaS environments?
A: Traditional SAM breaks because it assumes central procurement, stable ownership and predictable retirement paths.
Practitioner guidance
- Map SaaS ownership to accountable business and IT owners Create a live register that ties each SaaS application to a named owner for procurement, access, data and offboarding decisions.
- Extend joiner-mover-leaver processes into SaaS apps Make onboarding, role change and offboarding workflows trigger entitlement updates inside each high-value SaaS platform, not just in the directory.
- Track renewal and termination as identity controls Treat subscription renewal, cancellation and license reclamation as lifecycle events that remove access and reduce data exposure, not only as finance tasks.
Bottom line: SaaS adoption creates a governance gap when buying, ownership and access decisions move away from central IT.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
12/06/2026 10:46 pm
Traditional asset management fails when software ownership becomes distributed: ITAM and SAM were built for centrally procured software, not for a world where business users can buy SaaS directly. Once procurement fragments, the asset record stops being the control record. The practitioner consequence is that SaaS governance has to move from inventory management to lifecycle governance.
A few things that frame the scale:
- The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.
A question worth separating out:
Q: How can teams tell whether SaaS governance is actually working?
A: Look for evidence that discovered applications can be assigned an owner, tied to an access policy, and removed through an enforced workflow. If the platform can only report on SaaS usage but cannot drive deprovisioning or entitlement review, governance is still fragmented.
👉 Read our full editorial: SaaS sprawl is breaking traditional identity and asset controls
This post was modified 6 days ago by NHI Mgmt Group