Topic starter
12/06/2026 1:18 am
TL;DR: SaaS sprawl, shadow IT, and inconsistent tracking practices are widespread across industries, with security and compliance now treated as the main concerns, according to Zluri’s survey of 157 tech leaders. The pattern matters because unmanaged SaaS adoption expands the identity surface, weakens onboarding and offboarding, and makes least privilege harder to enforce.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “How Different Industries Manage SaaS: A Data-Backed Study”.
By the numbers:
- Zluri surveyed 157 tech leaders across North America, South America, Europe, and Asia Pacific.
- 52% of the industries in the survey track SaaS data manually through dashboards within the application itself.
- 80% of survey respondents said they do not use any tool to track their SaaS usage.
Key questions
Q: How should organisations govern SaaS sprawl across business units?
A: Assign clear application ownership, require periodic reconciliation between discovered apps and approved systems, and connect the results to joiner-mover-leaver processes.
Q: Why does manual SaaS tracking fail as an identity control?
A: Manual tracking fails because it records perception, not authoritative access state.
Q: What breaks when SaaS offboarding is not tied to identity revocation?
A: The organisation keeps paying for applications after the business no longer needs them, and access can remain active even after the relationship should end.
Practitioner guidance
- Build a governed SaaS inventory Create a single inventory that ties each application to an owner, an access model, and a renewal date so discovery feeds governance instead of finance alone.
- Link SaaS onboarding and offboarding to identity lifecycle events Require joiner, mover, and leaver triggers to update SaaS access rather than letting departments manage accounts independently.
- Replace self-reported usage tracking with authoritative entitlement data Use system-generated access and usage evidence to identify dormant access, duplicate apps, and exceptions that spreadsheets cannot reliably show.
Bottom line: SaaS sprawl expands the identity attack surface by multiplying accounts, permissions, and offboarding dependencies across business units.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 11:08 am
SaaS sprawl is now an identity control problem, not only a procurement problem. Once business units can adopt applications faster than governance can inventory them, the identity surface expands faster than recertification and offboarding can keep up. That changes the centre of gravity for IAM teams: the issue is no longer just who bought the app, but who can still access it after the business case has changed. Practitioners should treat SaaS growth as a governance drift indicator, not a usage metric alone.
A few things that frame the scale:
- The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.
A question worth separating out:
Q: What is the difference between SaaS configuration and SaaS governance?
A: SaaS configuration is the on or off state of a feature. SaaS governance is the policy, ownership, monitoring, and cleanup process that determines whether the feature can be used safely. A disabled setting may reduce exposure, but only governance ensures identities, content, and exceptions are managed over time.
👉 Read our full editorial: SaaS sprawl is becoming an identity governance problem
This post was modified 4 days ago by NHI Mgmt Group