Notifications
Clear all
Topic starter
12/06/2026 12:58 am
TL;DR: SAM risk should be prioritised by combining vendor risk and usage volume, with discovery, renewals, and vendor management used to reduce compliance exposure and software waste, according to Zluri. The governance gap is that software sprawl is an identity and access problem as much as an asset problem, because unmanaged SaaS often means unmanaged accounts, permissions, and renewal obligations.
NHIMG editorial — based on content published by Zluri: IT Teams How To Prioritize & Mitigate SAM Risks
Questions worth separating out
Q: How should teams prioritise SaaS applications for risk review?
A: Prioritise applications by combining business criticality with exposure volume.
Q: Why does SaaS sprawl create identity governance problems?
A: SaaS sprawl creates identity governance problems because every unmanaged application can hide active accounts, stale permissions, and forgotten integrations.
Q: How can organisations tell whether software discovery is enough?
A: Discovery is not enough if it only tells you an application exists.
Practitioner guidance
- Build a single SaaS risk register Track each application by business criticality, license exposure, access pattern, and renewal date so software decisions can be prioritised consistently.
- Tie discovery outputs to identity inventory Join SaaS discovery data with account, entitlement, and integration records so unmanaged applications do not mask unmanaged access.
- Use renewal dates as governance checkpoints Require an access and usage review before renewing any application that handles sensitive data, privileged workflows, or external vendor connections.
What's in the full article
Zluri's full article covers the operational detail this post intentionally leaves for the source:
- Detailed breakdown of the four SAM risk quadrants and how Zluri maps vendors into each one
- Step-by-step discovery workflow using SSO, finance systems, app integrations, desktop agents, and browser extensions
- Renewal alert timing and contract monitoring settings for SaaS lifecycle management
- Vendor management workflow examples for contract tracking, usage review, and renewal decisions
👉 Read Zluri's article on prioritising and mitigating SAM risks →
SaaS sprawl and SAM risk prioritization: what IAM teams miss?
Explore further
12/06/2026 10:34 am
SAM is an identity governance problem disguised as an asset problem. The article focuses on license counts, vendor audits, and cost control, but the underlying risk is access sprawl. SaaS tools usually sit behind authenticated sessions, delegated integrations, and user provisioning workflows, so poor inventory discipline becomes poor entitlement discipline very quickly. The practitioner takeaway is that software asset visibility and identity visibility must be managed as one governance surface.
A few things that frame the scale:
- 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
A question worth separating out:
Q: Who should own offboarding decisions for SaaS applications?
A: Offboarding should be owned jointly by business application owners, IAM or IGA teams, and procurement or vendor management. The business confirms need, identity teams remove access, and procurement closes the contract. That separation prevents stale software from surviving simply because no single team owns the full lifecycle.
👉 Read our full editorial: SAM risk prioritization exposes the governance gap in SaaS sprawl
