Topic starter
12/06/2026 12:42 am
TL;DR: Shadow IT, SaaS sprawl, and third-party data handling can outpace spreadsheet-based ITAM and leave organisations without clear ownership, contract oversight, or security accountability, according to Zluri's discussion with Jeremy Boerger. The governance problem is not visibility alone. It is the gap between knowing software exists and being able to control access, data flow, and offboarding.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “8 Key Learnings about Shadow IT and Rethinking ITAM from Jeremy Boerger”.
Key questions
Q: What breaks when shadow IT is only managed through inventory reviews?
A: Inventory reviews find tools, but they do not enforce behaviour.
Q: Why do browser extensions matter to identity and access governance?
A: Browser extensions matter because they are delegated software identities operating inside a user trust context.
Q: How should organisations govern shadow IT before it expands into operational risk?
A: Organisations should treat shadow IT as a governance problem, not just an isolated technology issue.
Practitioner guidance
- Map shadow SaaS to named business owners Create an accountable owner for every discovered SaaS application, including tools acquired outside procurement, so no service sits in an undefined governance state.
- Review third-party data terms before approval Require a security and legal check for where customer, employee, or operational data is stored, backed up, and subject to breach responsibility before a SaaS service is sanctioned.
- Tie SaaS discovery to offboarding When a service is retired or no longer sanctioned, verify that accounts, integrations, and data-sharing links are removed as part of the closure process.
Bottom line: Shadow IT and SaaS sprawl expose a structural limit in ITAM because visibility without ownership and offboarding does not create control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 10:08 am
Shadow IT turns ITAM into an identity governance problem. Once employees can subscribe to SaaS directly, the control question stops being what software exists and becomes who can bind organisational data and access to it. That is why software discovery alone is incomplete. Practitioners need to treat SaaS intake, owner assignment, and offboarding as part of the identity programme, not as a separate procurement clean-up exercise.
A question worth separating out:
Q: When does spreadsheet SaaS tracking stop being reliable?
A: It stops being reliable when the environment is large or dynamic enough that ownership, renewals, and licenses change faster than people can update the file. At that point, the spreadsheet becomes a lagging record, not an operating control, and teams need discovery and workflow-based governance instead of manual maintenance.
👉 Read our full editorial: Shadow IT and SaaS governance expose the limits of ITAM
This post was modified 4 days ago by NHI Mgmt Group