Notifications
Clear all
Topic starter
12/06/2026 10:00 pm
TL;DR: SaaS management centralises discovery, cost control, renewals, compliance, and security across expanding app portfolios, with Zluri arguing that unmanaged SaaS creates visibility gaps, shadow IT, sensitive-data exposure, and regulatory risk. The real governance issue is not app count alone, but ownership, lifecycle, and access sprawl across identities.
NHIMG editorial — based on content published by Zluri: SaaS Management What Is SaaS Management: A Comprehensive Guide 2026
By the numbers:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
Questions worth separating out
Q: How should security teams govern shadow SaaS apps that bypass IT approval?
A: Security teams should treat shadow SaaS as an identity and access exception, not just an inventory problem.
Q: Why do unmanaged SaaS apps create IAM and compliance risk?
A: Unmanaged SaaS apps create risk because they sit outside the normal lifecycle controls that govern access, offboarding, and review.
Q: What breaks when SaaS ownership is unclear?
A: When ownership is unclear, nobody can reliably answer who can approve access changes, who can retire the app, or who is responsible for its data.
Practitioner guidance
- Create a single SaaS ownership registry Map each application to a business owner, technical owner, data owner, and renewal approver so no app exists without an accountable lifecycle path.
- Tie SaaS reviews to access and renewal cycles Use recurring reviews to validate active users, dormant licenses, and auto-renewing contracts at the same time, so access and spend drift are remediated together.
- Classify shadow SaaS as an access exception When an app appears outside the approved stack, route it into identity and security review before it is allowed to connect to data, integrations, or SSO.
What's in the full article
Zluri's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step SaaS stack diagnosis methods for teams that need a practical assessment workflow.
- Detailed explanations of discovery channels such as ERP, HR, finance, and direct SaaS integrations.
- Business impact analysis guidance for weighing downtime, spend, and security exposure across the stack.
- Platform selection criteria for organisations evaluating SaaS management tooling at implementation stage.
👉 Read Zluri's guide to SaaS management, sprawl, and security risk →
SaaS sprawl and shadow IT: what identity teams need to govern?
Explore further
13/06/2026 12:28 am
SaaS management is identity governance by another name. The article describes discovery, ownership, renewals, and compliance, but those are the same governance primitives identity teams already manage for accounts and entitlements. The difference is that SaaS multiplies the number of systems and the number of decision points, which makes fragmented ownership the real failure mode. Practitioners should treat SaaS management as part of the identity programme, not as an adjacent procurement exercise.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
- Only 20% of organisations have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: How do organisations reduce SaaS sprawl without slowing the business?
A: Organisations reduce SaaS sprawl by combining discovery, ownership assignment, and review cadence instead of using one-time clean-up projects. The goal is to make every app visible, every owner accountable, and every renewal decision evidence-based. That preserves agility while preventing hidden access paths from accumulating over time.
👉 Read our full editorial: SaaS management exposes the identity governance gap in cloud sprawl
