Topic starter
11/06/2026 11:53 pm
TL;DR: As SaaS adoption expands, visibility gaps make it harder to prove GDPR compliance, track shadow IT, and understand where data and elevated access are flowing, according to Zluri’s interview with Todd Dekkinga. The core issue is that modern identity governance now extends beyond users and devices to app inventory, integrations, and access paths that traditional controls never fully mapped.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “Navigating Cybersecurity in the Age of SaaS: Insights from Todd Dekkinga, CISO @ Zluri”.
Key questions
Q: How should security teams govern access across SaaS sprawl?
A: Security teams should govern SaaS sprawl with one inventory, one policy model, and one review process that covers both human and non-human access.
A: SaaS environments create risk because access, configuration, and third party integrations can drift faster than teams can review them.
Q: What breaks when shadow IT sits outside identity governance controls?
A: Access reviews, offboarding, and privileged approval workflows lose reliability when shadow IT is outside the system of record.
Practitioner guidance
- Continuous discovery of the SaaS estate Establish always-on discovery that captures sanctioned apps, shadow IT, connected integrations and the accounts behind them.
- Review integrations as governed access paths Add API connections, OAuth grants and app-to-app links to the same review cycle used for privileged access.
- Include SaaS admins in privilege reviews Map who can administer each application, who can create connectors, and who can export data.
Bottom line: SaaS sprawl is not only an IT inventory problem. It creates a governance gap where applications, integrations and access paths escape normal identity controls.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 8:46 am
SaaS sprawl turns identity governance into an inventory problem first. When teams cannot reliably enumerate what has been adopted, they cannot prove who has access to what or which systems are carrying regulated data. That is not a tooling gap alone, it is a governance gap created by decentralised procurement and freemium adoption. The practitioner conclusion is simple: no inventory means no defensible access governance.
A few things that frame the scale:
- The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.
A question worth separating out:
Q: How do you govern SaaS access without relying on the corporate network boundary?
A: Shift the control point from the network perimeter to the application relationship. Governance should focus on which identities can reach which SaaS service, from which device context, through which connector, and under what business approval. That model is more realistic than assuming the office network still defines trust.
👉 Read our full editorial: SaaS sprawl is widening the identity and compliance gap
This post was modified 4 days ago by NHI Mgmt Group