Topic starter
12/06/2026 12:58 am
TL;DR: SAM risk should be prioritised by combining vendor risk and usage volume, with discovery, renewals, and vendor management used to reduce compliance exposure and software waste, according to Zluri. The governance gap is that software sprawl is an identity and access problem as much as an asset problem, because unmanaged SaaS often means unmanaged accounts, permissions, and renewal obligations.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “How To Prioritize & Mitigate SAM Risks”.
Key questions
Q: How should teams prioritise SaaS applications for risk review?
A: Prioritise applications by combining business criticality with exposure volume.
Q: Why do SaaS sprawl and identity governance fail in the same place?
A: They both depend on discovery happening before control.
Q: What do organisations get wrong about SAM renewals?
A: They treat renewals as a contract event instead of a governance checkpoint.
Practitioner guidance
- Prioritise SaaS by risk and usage volume Classify applications into a risk-volume matrix so governance effort goes first to tools with both high exposure and broad adoption.
- Tie every material app to an owner Assign an accountable business and technical owner for each SaaS application so renewals, access decisions, and offboarding do not drift between teams.
- Reconcile usage, licence, and employee records Compare actual active usage against purchased licences and workforce counts to identify oversubscription, dormant entitlements, and unapproved adoption.
Bottom line: SaaS sprawl is not only a licence efficiency issue. It becomes a governance problem when applications outgrow clear ownership, access review, and offboarding.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 10:34 am
SaaS sprawl is an identity governance problem disguised as SAM. The article treats risk as a software management issue, but unmanaged SaaS almost always means unmanaged access, unclear ownership, and incomplete offboarding. Once application sprawl reaches that point, licence control and access control are the same governance problem seen from different angles. Practitioners should stop treating SaaS inventory as a separate admin task and govern it as part of identity lifecycle.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How can teams tell whether SaaS governance is actually working?
A: Look for evidence that discovered applications can be assigned an owner, tied to an access policy, and removed through an enforced workflow. If the platform can only report on SaaS usage but cannot drive deprovisioning or entitlement review, governance is still fragmented.
👉 Read our full editorial: SAM risk prioritization exposes the governance gap in SaaS sprawl
This post was modified 4 days ago by NHI Mgmt Group