Topic starter
02/02/2026 9:57 pm
TL;DR: SaaS applications now average 8.6 non-human identities for every human identity, while 33% of integrations access sensitive data and 95% of obsolete tokens at Lionbridge were revoked through remediation workflows, according to Valence Security. The governance problem is no longer visibility alone; it is controlling distributed, high-privilege machine access before business-led integrations become unmanaged trust paths.
Editorial analysis by NHI Mgmt Group, based on content published by Valence Security: “Strengthening SaaS Applications with Secure Non-Human Identity Management”.
By the numbers:
- The 2024 State of SaaS Security Report found 8.6 non-human identities for every human identity on average.
- The 2024 State of SaaS Security Report found that 33% of integrations have access to sensitive data.
- Valence Security says its remediation workflows helped revoke 95% of obsolete or inactive tokens at Lionbridge almost immediately.
Key questions
Q: What breaks when SaaS integrations are not governed as non-human identities?
A: Teams lose visibility into who or what can reach connected systems, and attackers can use trusted credentials to move through those integrations without triggering normal human-account controls.
A: Excessive access expands the attack surface and makes abuse harder to contain.
Q: How should security teams detect stale or inactive SaaS credentials?
A: Track last-use signals, owner status, and business purpose for each integration credential, then flag anything that remains valid after the application stops using it.
Practitioner guidance
- Map every SaaS integration to its owning business function Create an inventory that ties each third-party integration to the business owner, the technical owner, and the NHI used for access.
- Enforce least privilege on integration scopes Review OAuth grants, API key permissions, and service account roles as privileged access decisions.
- Require lifecycle revocation for inactive integrations Set retirement criteria for integrations and revoke the associated token or key when the business use case ends, the vendor relationship changes, or the application is no longer in use.
Bottom line: SaaS-to-SaaS integrations widen the attack surface because they multiply service accounts, API keys, and OAuth tokens outside central oversight.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/10/2026 9:03 pm
Decentralised SaaS ownership creates an identity governance gap, not just a visibility gap. When marketing, sales, HR, or R&D can connect tools without central review, the security programme loses control of who authorises machine access and who retires it. That breaks the assumption that every productive integration passes through a governed identity lifecycle. The implication is that SaaS sprawl has to be treated as distributed access governance, not app inventory management.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- The average enterprise SaaS platform connects to 42 or more third-party applications through OAuth tokens, API keys, webhooks and automation platforms.
A question worth separating out:
Q: What is the difference between integration visibility and integration governance?
A: Visibility tells you which SaaS connections exist. Governance tells you who owns them, what they can access, when they should be revoked, and how their permissions are reviewed. Without governance, discovery only gives you an inventory of risk.
👉 Read our full editorial: SaaS-to-saas integrations are expanding NHI governance gaps