Topic starter
12/06/2026 9:16 pm
TL;DR: Visibility gaps in SaaS environments are letting employees adopt applications outside IT control, with JumpCloud citing 38% of admins who cannot discover all apps in use. The real issue is not just app sprawl, but unmanaged access paths, unreviewed OAuth grants, and weak accountability across identity-linked SaaS usage.
Editorial analysis by NHI Mgmt Group, based on content published by JumpCloud: “How JumpCloud SaaS Management Discovers Applications”.
By the numbers:
- 38% of admins admit they can’t even discover all applications in use.
Key questions
Q: What should IAM teams do first when they cannot see all SaaS applications in use?
A: Start by building a complete discovery picture from browser activity, SSO logs, and direct connectors.
Q: Why do unseen SaaS apps create security risk even when users are productive?
A: Unseen SaaS apps create risk because productivity does not remove the governance gap.
Q: What signals show that SaaS governance is not working?
A: Look for delayed offboarding, repeated manual exports, inconsistent access review responses, and inactive accounts that still carry paid licenses.
Practitioner guidance
- Map the SaaS estate from multiple discovery sources Combine browser-based discovery, SSO application inventories, and direct API connectors so approved and unapproved apps are visible in one governance view.
- Review OAuth grants for hidden delegated access Identify third-party permissions tied to work accounts, confirm the approved business need, and revoke access where the grant is no longer justified.
- Compare discovered apps against the SSO catalogue Reconcile what users actually access with what the identity platform marks as managed so shadow IT can be separated from sanctioned usage.
Bottom line: Shadow IT becomes an access problem when organisations cannot see which SaaS apps, accounts, and permissions are actually in use.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
12/06/2026 11:12 pm
Visibility debt is the real security debt in shadow IT. Once users can adopt SaaS tools faster than IT can inventory them, governance controls start operating on partial data. That undermines approval, review, and revocation processes across human identity and SaaS access, and the practitioner conclusion is simple: discovery quality sets the ceiling for every downstream control.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should security teams govern Shadow IT without slowing users down?
A: Start with visibility, not prohibition. Classify shadow applications by business value and data exposure, then apply graded responses such as approve, warn, or block. Pair that with clear ownership so business teams can explain why a tool exists and IAM can prove who can access it. The goal is controlled adoption, not blanket prevention.
👉 Read our full editorial: SaaS discovery gaps are turning shadow IT into access risk
This post was modified 6 days ago by NHI Mgmt Group