Topic starter
06/07/2026 9:44 am
TL;DR: Real-time visibility into app usage, shadow IT, and license optimisation lets IT translate access data into finance decisions, while also strengthening governance over who can reach which SaaS tools, according to Lumos. The deeper lesson is that access visibility is no longer just an IAM control, but a shared operating layer for spend, risk, and accountability.
Editorial analysis by NHI Mgmt Group, based on content published by Lumos: “How Lumos Uses Lumos to Build the CIO-CFO Partnership”.
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
Key questions
Q: How should security teams govern shadow IT in SaaS environments?
A: Security teams should govern shadow IT by treating it as unmanaged access, not just unsanctioned software.
Q: Why does access governance matter to finance as well as security?
A: Because access data shows not only who can reach applications, but also which tools are underused, duplicated or no longer creating value.
Q: What breaks when SaaS spend management is treated separately from identity governance?
A: The organisation can remove licences without removing accounts, or keep accounts active without any clear business need.
Practitioner guidance
- Build a single SaaS usage inventory Correlate Google OAuth, Okta and other authentication sources with sanctioned application records so that app usage, ownership and access rights are visible in one place.
- Use identity telemetry for shadow IT discovery Flag applications that appear in login data but not in procurement or approved software lists, then route them for review before they become normalised.
- Separate active from idle licenses Review usage patterns by account and application so underutilised subscriptions can be downgraded, reclaimed or consolidated with evidence.
Bottom line: Identity visibility is doing more than supporting IAM operations. It is becoming a shared evidence layer for security, spend control and executive accountability.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 10:01 am
Identity visibility has become a cross-functional control plane, not a reporting feature. Once app usage data is accurate enough to support budget decisions, it also becomes the authoritative source for governance conversations about access, risk and SaaS rationalisation. The practical consequence is that IAM, IGA and IT finance can no longer afford separate views of the same application estate. Teams should treat shared visibility as infrastructure for decision-making, not an afterthought.
A few things that frame the scale:
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: How can organisations tell whether contextual access decisions are improving governance?
A: Look for fewer routine exceptions, faster certification cycles, clearer audit trails, and reduced reviewer fatigue. If context is useful, it should improve consistency without increasing false confidence. If approvals get faster but entitlement quality stays poor, the programme has accelerated administration rather than governance.
👉 Read our full editorial: CIO and CFO alignment depends on identity visibility and access control